The 5 Vulnerabilities ESKA Finds in Every Second Penetration Test

When organizations think about penetration testing, they often expect sophisticated zero-day vulnerabilities or advanced attack techniques. In reality, the issues that put businesses at the greatest risk are usually much more mundane.

Based on penetration tests conducted by the ESKA team throughout 2024–2025, five security weaknesses appear so consistently that we actively look for them before running a single automated scanner.

And more often than not, we find them.

1. Publicly Accessible Remote Desktop (RDP)

Remote Desktop Protocol (RDP) allows administrators to manage Windows systems remotely. Unfortunately, it is also one of the most frequently abused entry points during real-world attacks.

What we typically find

Many organizations expose TCP port 3389 directly to the Internet without additional protection.

Typical findings include:

• Direct Internet exposure without a VPN

• No IP allowlisting

• Default administrator accounts

• Weak or reused passwords

• Missing Network Level Authentication (NLA)

Attackers continuously scan the Internet for exposed RDP services. Once discovered, they attempt password spraying, brute-force attacks, or credential stuffing using passwords leaked from previous breaches.

In many ransomware incidents, exposed RDP remains the initial point of compromise.

How to reduce the risk

• Never expose RDP directly to the Internet.

• Require VPN access before remote administration.

• Restrict access using IP allowlists whenever possible.

• Enable Network Level Authentication (NLA).

• Rename or disable the default Administrator account.

• Monitor authentication attempts and enforce account lockout policies.

2. Missing Multi-Factor Authentication on Critical Accounts

Multi-factor authentication (MFA) remains one of the most effective security controls available.

According to Microsoft, MFA prevents the overwhelming majority of password-based account compromise attempts.

Yet during many assessments we still discover that MFA is only partially deployed.

What we typically find

MFA may protect executive email accounts while remaining disabled for:

• VPN gateways

• Cloud administration portals

• GitHub or GitLab administrator accounts

• AWS, Azure, or Google Cloud consoles

• Backup infrastructure

• Password managers

• Domain administrator accounts

A single compromised password without MFA may provide attackers with unrestricted access to critical systems.

How to reduce the risk

• Identify all privileged and business-critical accounts.

• Require MFA for every administrative account without exception.

• Prefer authenticator applications or hardware security keys over SMS.

• Protect MFA recovery procedures with additional verification.

• Regularly review accounts that can bypass MFA policies.

3. Default or Weak Passwords on Network Equipment

This is one of those findings that sounds unbelievable until you see it repeatedly.

We still encounter:

• Cisco devices using default credentials

• MikroTik routers with "admin" accounts

• IP cameras using admin/admin

• Network printers with no authentication

• Switch management interfaces exposed internally with weak passwords

Often these devices have remained untouched since installation.

Why it matters

Network infrastructure forms the backbone of every corporate environment.

Compromising a router, switch, or firewall can allow attackers to:

• intercept network traffic

• modify routing

• disable security controls

• establish long-term persistence

• pivot deeper into internal networks

In some cases, exposed devices can even be located using Internet-wide search engines such as Shodan.

How to reduce the risk

• Inventory every network-connected device.

• Replace all default credentials immediately.

• Use unique passwords stored in an enterprise password manager.

• Restrict management interfaces to dedicated administrative networks.

• Review configurations during regular security assessments.

4. Outdated Software with Known Vulnerabilities

Modern attackers rarely need unknown vulnerabilities.

Public exploits for critical CVEs often become available within hours or days after disclosure.

What we typically find

During penetration tests we regularly discover:

• Windows servers missing security updates

• Microsoft Exchange servers vulnerable to publicly known exploits

• Outdated Confluence, GitLab, Jira, or Jenkins installations

• VPN appliances running years-old firmware

• Firewalls missing critical security patches

• Internet-facing applications with long-known vulnerabilities

Most of these issues already have publicly available exploit code.

How to reduce the risk

• Maintain a complete inventory of software assets.

• Establish a formal vulnerability and patch management process.

• Prioritize Internet-facing systems within 24–72 hours of critical security updates.

• Apply compensating controls when immediate patching is impossible.

• Perform regular vulnerability assessments to identify outdated systems before attackers do.

5. Excessive User Privileges

The Principle of Least Privilege is one of cybersecurity's most fundamental concepts.

Unfortunately, it is also one of the most commonly violated.

What we typically find

Examples include:

• Standard employees with local administrator rights

• Backup service accounts with Domain Admin privileges

• Developers having unrestricted production database access

• Former employees whose accounts remain active months after leaving

• Shared administrative accounts used across departments

Why it matters

Excessive privileges dramatically increase the impact of any compromise.

If an attacker gains access to an ordinary employee account that already has administrative permissions, privilege escalation becomes unnecessary.

This significantly simplifies lateral movement throughout the environment.

How to reduce the risk

• Review all privileged accounts regularly.

• Remove unnecessary local administrator rights.

• Separate standard and administrative accounts.

• Disable accounts immediately during employee offboarding.

• Implement Privileged Access Management (PAM) for sensitive administrative access.

• Periodically audit service accounts and technical identities.

Why Do These Vulnerabilities Still Exist?

None of these issues are particularly sophisticated.

They are well understood, thoroughly documented, and relatively inexpensive to fix.

Yet they continue to appear because organizations are busy.

Security improvements get postponed.

Legacy systems remain untouched.

Administrative access gradually expands.

Temporary exceptions become permanent.

Over time, these small weaknesses accumulate into significant business risk.

A Penetration Test Is About Prevention, Not Blame

A penetration test is not designed to prove that an organization has poor security.

Its purpose is to identify exploitable weaknesses before cybercriminals do.

The difference between "we completed a penetration test" and "we experienced a ransomware incident" is often nothing more than fixing vulnerabilities like these before they're exploited.

A Simple Security Checklist

If any of the situations above sound familiar, start by asking these questions:

• Is RDP exposed directly to the Internet?

• Do all privileged accounts require MFA?

• When were your servers, firewalls, VPNs, and network devices last patched?

• Are default passwords still present anywhere in your infrastructure?

• Do former employees still have active accounts?

• Does every user have only the permissions they genuinely need?

These checks cost very little.

Ignoring them can become extremely expensive.

Need an Independent Security Assessment?

At ESKA, we perform infrastructure, web application, API, cloud, and internal network penetration testing to help organizations identify exploitable vulnerabilities before attackers do.

Every engagement includes a detailed technical report, risk assessment, proof-of-concept findings, remediation guidance, and a management summary that helps security and business teams prioritize fixes.

Because the best time to discover a vulnerability is before someone else does.