Unmasking the top exploited vulnerabilities of 2022

Two Exploits Dominate 2022 Attack Traffic

The Cybersecurity and Infrastructure Security Agency (CISA) recently published its annual review of the most frequently exploited vulnerabilities. Cloudflare, operating as a reverse proxy for a substantial portion of web traffic, is well-positioned to measure real-world exploitation attempts against the CVEs named in that report. The findings reveal a stark disparity: two vulnerabilities account for nearly all of the attack traffic observed, while the others see comparatively negligible activity.

Analysis of requests flagged by WAF Managed Rules targeting the specific CVEs in the CISA report shows clear tiers of attacker interest.

The top slot belongs to CVE-2021-44228, widely known as Log4J, followed by the Atlassian Confluence Code Injection flaw CVE-2022-26134. The next tier consists of a chained set of three Microsoft Exchange Server vulnerabilities (CVE-2021-34473, CVE-2021-31207, and CVE-2021-34523), followed by the F5 BIG-IP RCE CVE-2022-1388 and two VMware flaws (CVE-2022-22954 and CVE-2022-22960). The list closes with another Atlassian Confluence issue, CVE-2021-26084.

Grouping these into five clusters, a critical pattern emerges: Log4J exploitation outnumbers the runner-up by more than an order of magnitude, and all remaining CVEs are even further behind. While the CISA advisory treats these as a uniform list, the telemetry suggests two distinct groups: Log4J as a dominant outlier, with the other zero-days forming a secondary tier of comparable volume.

CVE-2021-44228: The Log4J Vulnerability

The Log4J RCE flaw remains one of the most impactful exploits of the decade due to its potential for full remote system compromise. Cloudflare issued managed rules within hours of public disclosure, rolling out detections in three emergency releases on December 10, 14, and 16, 2021. These rules classify attacks into four categories:

• Log4j Headers: Attack pattern in HTTP header
• Log4j Body: Attack pattern in HTTP Body
• Log4j URI: Attack Pattern in URI
• Log4j Body Obfuscation: Obfuscated Attack pattern

HTTP header-based attacks appear more frequently than body-based attempts. Exploitation activity remains persistent with distinct peaks and a notable rise into mid-2023.

Given the severity, Cloudflare announced on March 15, 2022 that all customers, including Free plan users, would receive WAF Managed Rules for high-impact vulnerabilities. This coverage extends to Shellshock and widely deployed WordPress exploits, providing baseline protection regardless of budget.

Atlassian Confluence Code Injection

The second most exploited CVE targeted Atlassian Confluence. As organizations increasingly rely on knowledge-management systems, attackers have taken notice. To counter this flaw, the WAF team issued two emergency releases on June 4 and June 7, 2022, making two rules available to all users:

• Atlassian Confluence - Code Injection - CVE:CVE-2022-26134
• Atlassian Confluence - Code Injection - Extended - CVE:CVE-2022-26134

Attack volume shows a sharp peak followed by a gradual decline as patches were applied. Both Log4J and this Confluence flaw display seasonal patterns, with higher activity from late 2022 into March 2023 likely reflecting coordinated attack campaigns.

Microsoft Exchange SSRF and RCE Chain

Three previously unknown bugs were chained to achieve remote code execution on Microsoft Exchange servers. The widespread adoption of these systems made the exploits a serious threat. Cloudflare published a rule under its March 3, 2022 emergency release addressing the vulnerability chain: Microsoft Exchange SSRF and RCE vulnerability - CVE:CVE-2022-41040, CVE:CVE-2022-41082.

F5 BIG-IP RCE

The F5 BIG-IP issue allows an unauthenticated attacker with network connectivity—either via the management interface or self-assigned IP addresses—to execute unrestricted system commands. Cloudflare's emergency release on May 5, 2022 added detection under the rule Command Injection - RCE in BIG-IP - CVE:CVE-2022-1388. Exploitation shows a steady background pattern without clear campaign spikes, except for one observed in late June 2023.

VMware Workspace ONE Access and Identity Manager

A server-side template injection in VMware products allows remote attackers to execute arbitrary commands as the VMware user. Chained with CVE-2022-22960, a local privilege escalation issue, the combination grants remote root-level command execution. Cloudflare's WAF rule was published in its release dated May 5, 2022.

Confluence Server OGNL Injection

Another Atlassian Confluence flaw, this OGNL injection allows unauthenticated code execution on servers or data center instances. An emergency release followed on September 9, 2022, but exploitation attempts have remained comparatively low over the past year when set against the other CVEs in the CISA list.

Recommended Defensive Measures

Server administrators should prioritize patching as fixes become available. For Cloudflare customers, new rules addressing CVEs and zero-day threats are updated weekly in the Managed Ruleset, with emergency releases for high-risk flaws. Enterprise customers additionally have access to the WAF Attack Score, an AI-based detection feature that supplements signature-based rules to identify unknown threats and bypass attempts. Combining rule-based signatures with machine learning offers a more robust defense against both known and emerging threats.

Cloudflare's telemetry reinforces the CISA report while highlighting the concentration of attacker effort: the top two vulnerabilities draw several orders of magnitude more exploitation attempts than the rest of the list. Prioritizing patch management according to such intelligence is critical—though all software should ultimately be kept current. A well-configured WAF provides an additional layer of security, buying time to secure underlying systems against existing and future vulnerabilities.