Micro, small and medium-sized enterprises (TPE, PME, ETI) now represent 48% of ransomware victims identified by ANSSI, up from 37% the previous year. This increase places these structures on the front line, far ahead of local authorities or healthcare institutions. Three types of web vulnerabilities recur in the majority of documented incidents, and their correction does not require an excessive budget.
Web vulnerabilities of SMEs: a numerical overview of attack vectors
Public reports allow for the prioritization of vulnerabilities that are actually exploited. The table below summarizes the three most common web vulnerabilities in incidents affecting small and medium-sized enterprises, cross-referencing the available data.
| Type of vulnerability | Common vector | Typical consequence | Correction level |
|---|---|---|---|
| Unpatched CMS and third-party components | Outdated WordPress plugin, vulnerable JavaScript library | Code injection, redirection to malicious site | Regular update (free) |
| Exposed access portal without MFA | Accessible admin interface, VPN without two-factor authentication | Account compromise, lateral movement | Enable MFA (low cost) |
| Unencrypted communications | Forms in HTTP, clear data transfers | Client data interception, credential theft | TLS certificate (often free) |
What stands out from this comparison: the most exploited vulnerabilities are also the least costly to fix. The gap between the simplicity of the fixes and the severity of the consequences explains why attackers continue to target SMEs.
A detailed analysis of SME web protection according to Viruslab confirms that these three categories account for the overwhelming majority of incidents observed on small professional sites.
Outdated CMS: the web vulnerability that SMEs fix too late
The CISA KEV catalog, which lists vulnerabilities actively exploited in real-world conditions, regularly includes flaws related to CMS or their extensions. An abandoned WordPress plugin, a Joomla version that hasn’t received a patch in months: these situations create permanent entry points.
The problem is not limited to the CMS itself. JavaScript libraries embedded in themes or third-party modules accumulate vulnerabilities that go under the radar. An SME managing its site without a dedicated technical provider typically does not monitor these dependencies.
Prioritize fixes based on actual risk
Not all updates are equal. Fixes related to vulnerabilities already exploited in real-world conditions are a priority over comfort or interface updates. Lists of actively exploited vulnerabilities, such as the one maintained by CISA, allow for sorting.
- Check weekly if the installed extensions are listed in the security alerts published by the CMS vendor
- Remove any inactive or unmaintained plugins for more than six months, even if they seem functional
- Automate minor security updates to reduce the time between patch release and application
This update discipline represents the first line of defense. It requires neither software investment nor advanced skills, but a regularity that many SMEs have not yet integrated into their routine.
Exposed admin portals: VPN access and interfaces without two-factor authentication
A WordPress admin panel accessible from any IP address, a company VPN protected by a simple password: these configurations remain common. The absence of MFA on remote access is the primary factor for account compromise in companies with fewer than 250 employees.
Attackers do not need sophisticated techniques. Credential stuffing (reusing stolen credentials on other services) is sufficient when no second authentication factor is enabled. An employee using the same password for personal email and the site admin interface exposes the entire infrastructure.
Reduce the attack surface of remote access
Restricting access to the admin panel by IP address, when possible, eliminates the majority of automated attempts. For VPNs, enabling MFA significantly reduces the risk of compromise.
However, simply implementing MFA does not cover everything. An overlooked admin account, created during the initial installation and never deleted, remains a target. Auditing the list of privileged accounts at least once a quarter is part of the actions that cost zero euros and reduce the exploitable perimeter.
NIS 2 Directive and cybersecurity obligations for subcontracting SMEs
The transposition of the NIS 2 directive into French law modifies the regulatory framework for many SMEs, including those that do not consider themselves direct targets. The cascading effect of NIS 2 affects subcontractors and suppliers of regulated entities, who will need to demonstrate a minimum level of security.
For an SME subcontracting for an operator classified as an “important entity,” this concretely means that the three vulnerabilities described above (unpatched CMS, access without MFA, unencrypted communications) could become grounds for contractual non-compliance. The risk is no longer just technical: it becomes legal and commercial.
Incident notifications and executive responsibility
NIS 2 introduces notification deadlines in the event of a significant incident. Executives of affected entities bear direct responsibility for compliance. For SMEs, this obligation transforms cybersecurity from a technical issue delegated to IT into a governance issue.
- Map contracts with clients subject to NIS 2 to anticipate the security requirements they will impose
- Document the protective measures in place (updates, MFA, encryption) to be able to respond to a client audit
- Establish an internal incident notification procedure, even simplified, to meet regulatory deadlines
The growing share of micro, small, and medium-sized enterprises among ransomware victims and the gradual implementation of NIS 2 converge towards the same conclusion. The three most exploited vulnerabilities are known, documented, and fixable at low cost. What is most often lacking is not the budget, but the regularity in applying fixes and the consideration of the issue at the management level.
