Most Exploited Vulnerabilities2022
Query
DeviceTvmSoftwareVulnerabilities
// Filter on devices that are vulnerable to one of the vulnerabilities
| where CveId in (2022MostExploited)
// Add additional context
| join kind=inner (DeviceTvmSoftwareVulnerabilitiesKB
| project CveId, VulnerabilityDescription)
on CveId
| project DeviceName, OSPlatform, CveId, VulnerabilityDescriptionAbout this query
Explanation
This query is designed to identify devices that are vulnerable to some of the most exploited security vulnerabilities in 2022. Here's a simple breakdown of what the query does:
-
Define a List of Vulnerabilities: It starts by creating a list of Common Vulnerabilities and Exposures (CVEs) that were most exploited in 2022. These include vulnerabilities in products from companies like Microsoft, Fortinet, Zoho, Atlassian, Apache, VMware, and F5 Networks.
-
Filter Devices: The query then checks which devices in the network have these vulnerabilities. It looks for devices that have any of the listed CVEs.
-
Add Contextual Information: For each vulnerable device, the query retrieves additional information about the vulnerability, such as a description, by joining with another dataset that contains detailed information about each CVE.
-
Output Results: Finally, it outputs a list of devices, their operating systems, the specific CVE they are vulnerable to, and a description of the vulnerability. This information can be used to prioritize patching efforts to secure the network.
The query is part of a cybersecurity effort to prevent breaches by identifying and addressing known vulnerabilities that attackers have frequently exploited.
Details
Bert-Jan Pals
Released: January 18, 2026
Tables
Keywords
Operators