Ransomware Vulnerabilities
The 361 entries in the CISA Known Exploited Vulnerabilities catalog that CISA marks as known to be used in ransomware campaigns, with the vendors and weaknesses behind them. Every figure is recalculated from the catalog feed on each sync.
RansomwareRansomware-Linked
361
ShareShare of KEV
21%
12 MonthsAdded in 12 Months
30
LatestLatest Addition
2026-08-18
SyncedLast Synced
2026-10-12
Key Findings
- As of October 12, 2026, CISA marks 361 of the 1,739 entries in the KEV catalog (21%) as known to be used in ransomware campaigns.
- 30 of the 303 vulnerabilities CISA added to the KEV catalog in the 12 months to October 12, 2026 are marked as known to be used in ransomware campaigns.
- Microsoft has the most ransomware-linked KEV entries (117), followed by Fortinet (14) and Oracle (13), as of October 12, 2026.
- Among vendors with at least 20 KEV entries, Fortinet has the highest share marked for ransomware use: 45% (14 of 31), as of October 12, 2026.
- Among ransomware-linked KEV entries whose CVE record names a weakness, the most common is Deserialization of Untrusted Data (CWE-502), in 17 of 109 entries, as of October 12, 2026.
- 57% of ransomware-linked KEV entries (205 of 361) are for CVEs published in 2021 or earlier, as of October 12, 2026.
Top Vendors
Top Weaknesses
- 17
- 6
- 6
- 6
- 6
- 5
- 5
- 4
- 4
- 4
Counted over the 109 ransomware-linked entries (30%) whose CVE record names a CWE. An entry with more than one CWE counts once for each.
Ransomware-Linked Entries by Year Added
- 202184
- 2022132
- 202343
- 202444
- 202531
- 202627
The year CISA added each entry to the catalog. The ransomware marking is the current value in the catalog feed, not the value on the day the entry was added.
All Ransomware-Linked Entries
361 entries| CVE | Vulnerability | CVSS | EPSS | Added | Due |
|---|---|---|---|---|---|
| CVE-2026-59310 Broadcom VMware vCenter Path Traversal Vulnerability Ransomware | Broadcom VMware vCenter Path Traversal Vulnerability Ransomware | 9.8 | 2.6% | 2026-08-18 | 2026-08-21 |
| CVE-2026-63077 JetBrains TeamCity Deserialization of Untrusted Data Vulnerability Ransomware | JetBrains TeamCity Deserialization of Untrusted Data Vulnerability Ransomware | 9.8 | 89.6% | 2026-08-05 | 2026-08-08 |
| CVE-2026-20316 Cisco Secure Firewall Management Center Use of Hard-coded Password Vulnerability Ransomware | Cisco Secure Firewall Management Center Use of Hard-coded Password Vulnerability Ransomware | 5.3 | 35.1% | 2026-07-29 | 2026-08-01 |
| CVE-2026-15409 SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability Ransomware | SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability Ransomware | 10.0 | 6.8% | 2026-07-14 | 2026-07-17 |
| CVE-2026-15410 SonicWall SMA1000 Appliances Code Injection Vulnerability Ransomware | SonicWall SMA1000 Appliances Code Injection Vulnerability Ransomware | 7.2 | 11.8% | 2026-07-14 | 2026-07-17 |
| CVE-2026-45659 Microsoft SharePoint Server Deserialization of Untrusted Data Vulnerability Ransomware | Microsoft SharePoint Server Deserialization of Untrusted Data Vulnerability Ransomware | 8.8 | 2.7% | 2026-07-01 | 2026-07-04 |
| CVE-2026-12569 PTC Windchill and FlexPLM Improper Input Validation Vulnerability Ransomware | PTC Windchill and FlexPLM Improper Input Validation Vulnerability Ransomware | 9.3 | 46.0% | 2026-06-25 | 2026-06-28 |
| CVE-2026-35273 Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability Ransomware | Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability Ransomware | 9.8 | 9.4% | 2026-06-12 | 2026-06-15 |
| CVE-2026-50751 Check Point Security Gateway Improper Authentication Vulnerability Ransomware | Check Point Security Gateway Improper Authentication Vulnerability Ransomware | 9.3 | 85.3% | 2026-06-08 | 2026-06-11 |
| CVE-2026-0257 Palo Alto Networks PAN-OS Authentication Bypass Vulnerability Ransomware | Palo Alto Networks PAN-OS Authentication Bypass Vulnerability Ransomware | 7.8 | 96.9% | 2026-05-29 | 2026-06-01 |
| CVE-2026-45321 TanStack Unspecified Vulnerability Ransomware | TanStack Unspecified Vulnerability Ransomware | 9.6 | 1.1% | 2026-05-27 | 2026-06-10 |
| CVE-2026-48027 Nx Console Embedded Malicious Code Vulnerability Ransomware | Nx Console Embedded Malicious Code Vulnerability Ransomware | 9.3 | 1.3% | 2026-05-27 | 2026-06-10 |
| CVE-2026-41940 WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function Vulnerability Ransomware | WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function Vulnerability Ransomware | 9.8 | 98.5% | 2026-04-30 | 2026-05-03 |
| CVE-2024-1708 ConnectWise ScreenConnect Path Traversal Vulnerability Ransomware | ConnectWise ScreenConnect Path Traversal Vulnerability Ransomware | 8.4 | 95.4% | 2026-04-28 | 2026-05-12 |
| CVE-2024-57726 SimpleHelp Missing Authorization Vulnerability Ransomware | SimpleHelp Missing Authorization Vulnerability Ransomware | 9.9 | 66.6% | 2026-04-24 | 2026-05-08 |
| CVE-2024-57728 SimpleHelp Path Traversal Vulnerability Ransomware | SimpleHelp Path Traversal Vulnerability Ransomware | 7.2 | 64.7% | 2026-04-24 | 2026-05-08 |
| CVE-2026-33825 Microsoft Defender Insufficient Granularity of Access Control Vulnerability Ransomware | Microsoft Defender Insufficient Granularity of Access Control Vulnerability Ransomware | 7.8 | 0.4% | 2026-04-22 | 2026-05-06 |
| CVE-2023-27351 PaperCut NG/MF Improper Authentication Vulnerability Ransomware | PaperCut NG/MF Improper Authentication Vulnerability Ransomware | 8.2 | 78.1% | 2026-04-20 | 2026-05-04 |
| CVE-2024-27199 JetBrains TeamCity Relative Path Traversal Vulnerability Ransomware | JetBrains TeamCity Relative Path Traversal Vulnerability Ransomware | 7.3 | 100.0% | 2026-04-20 | 2026-05-04 |
| CVE-2023-21529 Microsoft Exchange Server Deserialization of Untrusted Data Vulnerability Ransomware | Microsoft Exchange Server Deserialization of Untrusted Data Vulnerability Ransomware | 8.8 | 59.3% | 2026-04-13 | 2026-04-27 |
| CVE-2025-60710 Microsoft Windows Link Following Vulnerability Ransomware | Microsoft Windows Link Following Vulnerability Ransomware | 7.8 | 4.6% | 2026-04-13 | 2026-04-27 |
| CVE-2026-20131 Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management Deserialization of Untrusted Data Vulnerability Ransomware | Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management Deserialization of Untrusted Data Vulnerability Ransomware | 10.0 | 43.2% | 2026-03-19 | 2026-03-22 |
| CVE-2025-26399 SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability Ransomware | SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability Ransomware | 9.8 | 89.5% | 2026-03-09 | 2026-03-12 |
| CVE-2026-1731 BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) OS Command Injection Vulnerability Ransomware | BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) OS Command Injection Vulnerability Ransomware | 9.9 | 91.7% | 2026-02-13 | 2026-02-16 |
| CVE-2026-24423 SmarterTools SmarterMail Missing Authentication for Critical Function Vulnerability Ransomware | SmarterTools SmarterMail Missing Authentication for Critical Function Vulnerability Ransomware | 9.3 | 88.2% | 2026-02-05 | 2026-02-26 |
| CVE-2025-52691 SmarterTools SmarterMail Unrestricted Upload of File with Dangerous Type Vulnerability Ransomware | SmarterTools SmarterMail Unrestricted Upload of File with Dangerous Type Vulnerability Ransomware | 10.0 | 85.7% | 2026-01-26 | 2026-02-16 |
| CVE-2026-23760 SmarterTools SmarterMail Authentication Bypass Using an Alternate Path or Channel Vulnerability Ransomware | SmarterTools SmarterMail Authentication Bypass Using an Alternate Path or Channel Vulnerability Ransomware | 9.3 | 96.5% | 2026-01-26 | 2026-02-16 |
| CVE-2025-14733 WatchGuard Firebox Out of Bounds Write Vulnerability Ransomware | WatchGuard Firebox Out of Bounds Write Vulnerability Ransomware | 9.3 | 26.5% | 2025-12-19 | 2025-12-26 |
| CVE-2025-55182 Meta React Server Components Remote Code Execution Vulnerability Ransomware | Meta React Server Components Remote Code Execution Vulnerability Ransomware | 10.0 | 99.8% | 2025-12-05 | 2025-12-12 |
| CVE-2025-61884 Oracle E-Business Suite Server-Side Request Forgery (SSRF) Vulnerability Ransomware | Oracle E-Business Suite Server-Side Request Forgery (SSRF) Vulnerability Ransomware | 7.5 | 95.9% | 2025-10-20 | 2025-11-10 |
| CVE-2021-43226 Microsoft Windows Privilege Escalation Vulnerability Ransomware | Microsoft Windows Privilege Escalation Vulnerability Ransomware | 7.8 | 3.3% | 2025-10-06 | 2025-10-27 |
| CVE-2025-61882 Oracle E-Business Suite Unspecified Vulnerability Ransomware | Oracle E-Business Suite Unspecified Vulnerability Ransomware | 9.8 | 99.7% | 2025-10-06 | 2025-10-27 |
| CVE-2025-10035 Fortra GoAnywhere MFT Deserialization of Untrusted Data Vulnerability Ransomware | Fortra GoAnywhere MFT Deserialization of Untrusted Data Vulnerability Ransomware | 10.0 | 99.8% | 2025-09-29 | 2025-10-20 |
| CVE-2025-8088 RARLAB WinRAR Path Traversal Vulnerability Ransomware | RARLAB WinRAR Path Traversal Vulnerability Ransomware | 8.4 | 94.3% | 2025-08-12 | 2025-09-02 |
| CVE-2025-49704 Microsoft SharePoint Code Injection Vulnerability Ransomware | Microsoft SharePoint Code Injection Vulnerability Ransomware | 8.8 | 100.0% | 2025-07-22 | 2025-07-23 |
| CVE-2025-49706 Microsoft SharePoint Improper Authentication Vulnerability Ransomware | Microsoft SharePoint Improper Authentication Vulnerability Ransomware | 6.5 | 99.1% | 2025-07-22 | 2025-07-23 |
| CVE-2025-53770 Microsoft SharePoint Deserialization of Untrusted Data Vulnerability Ransomware | Microsoft SharePoint Deserialization of Untrusted Data Vulnerability Ransomware | 9.8 | 100.0% | 2025-07-20 | 2025-07-21 |
| CVE-2025-5777 Citrix NetScaler ADC and Gateway Out-of-Bounds Read Vulnerability Ransomware | Citrix NetScaler ADC and Gateway Out-of-Bounds Read Vulnerability Ransomware | 9.3 | 100.0% | 2025-07-10 | 2025-07-11 |
| CVE-2019-6693 Fortinet FortiOS Use of Hard-Coded Credentials Vulnerability Ransomware | Fortinet FortiOS Use of Hard-Coded Credentials Vulnerability Ransomware | 6.5 | 5.8% | 2025-06-25 | 2025-07-16 |
| CVE-2025-42999 SAP NetWeaver Deserialization Vulnerability Ransomware | SAP NetWeaver Deserialization Vulnerability Ransomware | 9.1 | 12.7% | 2025-05-15 | 2025-06-05 |
| CVE-2025-3248 Langflow Missing Authentication Vulnerability Ransomware | Langflow Missing Authentication Vulnerability Ransomware | 9.8 | 100.0% | 2025-05-05 | 2025-05-26 |
| CVE-2025-31324 SAP NetWeaver Unrestricted File Upload Vulnerability Ransomware | SAP NetWeaver Unrestricted File Upload Vulnerability Ransomware | 10.0 | 99.5% | 2025-04-29 | 2025-05-20 |
| CVE-2025-29824 Microsoft Windows Common Log File System (CLFS) Driver Use-After-Free Vulnerability Ransomware | Microsoft Windows Common Log File System (CLFS) Driver Use-After-Free Vulnerability Ransomware | 7.8 | 13.9% | 2025-04-08 | 2025-04-29 |
| CVE-2025-31161 CrushFTP Authentication Bypass Vulnerability Ransomware | CrushFTP Authentication Bypass Vulnerability Ransomware | 9.8 | 100.0% | 2025-04-07 | 2025-04-28 |
| CVE-2025-22457 Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability Ransomware | Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability Ransomware | 9.0 | 100.0% | 2025-04-04 | 2025-04-11 |
| CVE-2025-24472 Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability Ransomware | Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability Ransomware | 8.1 | 7.2% | 2025-03-18 | 2025-04-08 |
| CVE-2025-26633 Microsoft Windows Management Console (MMC) Improper Neutralization Vulnerability Ransomware | Microsoft Windows Management Console (MMC) Improper Neutralization Vulnerability Ransomware | 7.0 | 30.4% | 2025-03-11 | 2025-04-01 |
| CVE-2025-22225 VMware ESXi Arbitrary Write Vulnerability Ransomware | VMware ESXi Arbitrary Write Vulnerability Ransomware | 8.2 | 1.0% | 2025-03-04 | 2025-03-25 |
| CVE-2018-8639 Microsoft Windows Win32k Improper Resource Shutdown or Release Vulnerability Ransomware | Microsoft Windows Win32k Improper Resource Shutdown or Release Vulnerability Ransomware | 8.4 | 22.2% | 2025-03-03 | 2025-03-24 |
| CVE-2024-53704 SonicWall SonicOS SSLVPN Improper Authentication Vulnerability Ransomware | SonicWall SonicOS SSLVPN Improper Authentication Vulnerability Ransomware | 8.2 | 95.1% | 2025-02-18 | 2025-03-11 |
| CVE-2024-57727 SimpleHelp Path Traversal Vulnerability Ransomware | SimpleHelp Path Traversal Vulnerability Ransomware | 9.1 | 96.6% | 2025-02-13 | 2025-03-06 |
| CVE-2020-29574 CyberoamOS (CROS) SQL Injection Vulnerability Ransomware | CyberoamOS (CROS) SQL Injection Vulnerability Ransomware | 9.8 | 4.7% | 2025-02-06 | 2025-02-27 |
| CVE-2025-23006 SonicWall SMA1000 Appliances Deserialization Vulnerability Ransomware | SonicWall SMA1000 Appliances Deserialization Vulnerability Ransomware | 9.8 | 23.4% | 2025-01-24 | 2025-02-14 |
| CVE-2024-55591 Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability Ransomware | Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability Ransomware | 9.6 | 94.1% | 2025-01-14 | 2025-01-21 |
| CVE-2023-48365 Qlik Sense HTTP Tunneling Vulnerability Ransomware | Qlik Sense HTTP Tunneling Vulnerability Ransomware | 9.6 | 47.5% | 2025-01-13 | 2025-02-03 |
| CVE-2025-0282 Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability Ransomware | Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability Ransomware | 9.0 | 100.0% | 2025-01-08 | 2025-01-15 |
| CVE-2024-41713 Mitel MiCollab Path Traversal Vulnerability Ransomware | Mitel MiCollab Path Traversal Vulnerability Ransomware | 9.1 | 98.1% | 2025-01-07 | 2025-01-28 |
| CVE-2024-55550 Mitel MiCollab Path Traversal Vulnerability Ransomware | Mitel MiCollab Path Traversal Vulnerability Ransomware | 4.4 | 38.2% | 2025-01-07 | 2025-01-28 |
| CVE-2024-55956 Cleo Multiple Products Unauthenticated File Upload Vulnerability Ransomware | Cleo Multiple Products Unauthenticated File Upload Vulnerability Ransomware | 9.8 | 94.0% | 2024-12-17 | 2025-01-07 |
| CVE-2024-50623 Cleo Multiple Products Unrestricted File Upload Vulnerability Ransomware | Cleo Multiple Products Unrestricted File Upload Vulnerability Ransomware | 9.8 | 98.6% | 2024-12-13 | 2025-01-03 |
| CVE-2024-51378 CyberPanel Incorrect Default Permissions Vulnerability Ransomware | CyberPanel Incorrect Default Permissions Vulnerability Ransomware | 10.0 | 94.7% | 2024-12-04 | 2024-12-25 |
| CVE-2024-11667 Zyxel Multiple Firewalls Path Traversal Vulnerability Ransomware | Zyxel Multiple Firewalls Path Traversal Vulnerability Ransomware | 7.5 | 2.9% | 2024-12-03 | 2024-12-24 |
| CVE-2023-28461 Array Networks AG and vxAG ArrayOS Missing Authentication for Critical Function Vulnerability Ransomware | Array Networks AG and vxAG ArrayOS Missing Authentication for Critical Function Vulnerability Ransomware | 9.8 | 68.1% | 2024-11-25 | 2024-12-16 |
| CVE-2024-0012 Palo Alto Networks PAN-OS Management Interface Authentication Bypass Vulnerability Ransomware | Palo Alto Networks PAN-OS Management Interface Authentication Bypass Vulnerability Ransomware | 9.3 | 99.9% | 2024-11-18 | 2024-12-09 |
| CVE-2024-9474 Palo Alto Networks PAN-OS Management Interface OS Command Injection Vulnerability Ransomware | Palo Alto Networks PAN-OS Management Interface OS Command Injection Vulnerability Ransomware | 6.9 | 94.8% | 2024-11-18 | 2024-12-09 |
| CVE-2024-49039 Microsoft Windows Task Scheduler Privilege Escalation Vulnerability Ransomware | Microsoft Windows Task Scheduler Privilege Escalation Vulnerability Ransomware | 8.8 | 14.2% | 2024-11-12 | 2024-12-03 |
| CVE-2024-51567 CyberPanel Incorrect Default Permissions Vulnerability Ransomware | CyberPanel Incorrect Default Permissions Vulnerability Ransomware | 10.0 | 86.6% | 2024-11-07 | 2024-11-28 |
| CVE-2024-38094 Microsoft SharePoint Deserialization Vulnerability Ransomware | Microsoft SharePoint Deserialization Vulnerability Ransomware | 7.2 | 50.9% | 2024-10-22 | 2024-11-12 |
| CVE-2024-40711 Veeam Backup and Replication Deserialization Vulnerability Ransomware | Veeam Backup and Replication Deserialization Vulnerability Ransomware | 9.8 | 90.4% | 2024-10-17 | 2024-11-07 |
| CVE-2024-30088 Microsoft Windows Kernel TOCTOU Race Condition Vulnerability Ransomware | Microsoft Windows Kernel TOCTOU Race Condition Vulnerability Ransomware | 7.0 | 68.2% | 2024-10-15 | 2024-11-05 |
| CVE-2024-9680 Mozilla Firefox Use-After-Free Vulnerability Ransomware | Mozilla Firefox Use-After-Free Vulnerability Ransomware | 9.8 | 23.2% | 2024-10-15 | 2024-11-05 |
| CVE-2020-0618 Microsoft SQL Server Reporting Services Remote Code Execution Vulnerability Ransomware | Microsoft SQL Server Reporting Services Remote Code Execution Vulnerability Ransomware | 9.8 | 99.0% | 2024-09-18 | 2024-10-09 |
| CVE-2024-6670 Progress WhatsUp Gold SQL Injection Vulnerability Ransomware | Progress WhatsUp Gold SQL Injection Vulnerability Ransomware | 9.8 | 93.0% | 2024-09-16 | 2024-10-07 |
| CVE-2017-1000253 Linux Kernel PIE Stack Buffer Corruption Vulnerability Ransomware | Linux Kernel PIE Stack Buffer Corruption Vulnerability Ransomware | 7.8 | 10.7% | 2024-09-09 | 2024-09-30 |
| CVE-2024-40766 SonicWall SonicOS Improper Access Control Vulnerability Ransomware | SonicWall SonicOS Improper Access Control Vulnerability Ransomware | 9.3 | 18.4% | 2024-09-09 | 2024-09-30 |
| CVE-2024-23897 Jenkins Command Line Interface (CLI) Path Traversal Vulnerability Ransomware | Jenkins Command Line Interface (CLI) Path Traversal Vulnerability Ransomware | 9.8 | 100.0% | 2024-08-19 | 2024-09-09 |
| CVE-2024-37085 VMware ESXi Authentication Bypass Vulnerability Ransomware | VMware ESXi Authentication Bypass Vulnerability Ransomware | 6.8 | 26.8% | 2024-07-30 | 2024-08-20 |
| CVE-2024-23692 Rejetto HTTP File Server Improper Neutralization of Special Elements Used in a Template Engine Vulnerability Ransomware | Rejetto HTTP File Server Improper Neutralization of Special Elements Used in a Template Engine Vulnerability Ransomware | 9.8 | 99.5% | 2024-07-09 | 2024-07-30 |
| CVE-2024-26169 Microsoft Windows Error Reporting Service Improper Privilege Management Vulnerability Ransomware | Microsoft Windows Error Reporting Service Improper Privilege Management Vulnerability Ransomware | 7.8 | 4.0% | 2024-06-13 | 2024-07-04 |
| CVE-2024-4577 PHP-CGI OS Command Injection Vulnerability Ransomware | PHP-CGI OS Command Injection Vulnerability Ransomware | 9.8 | 100.0% | 2024-06-12 | 2024-07-03 |
| CVE-2024-1086 Linux Kernel Use-After-Free Vulnerability Ransomware | Linux Kernel Use-After-Free Vulnerability Ransomware | 7.8 | 28.1% | 2024-05-30 | 2024-06-20 |
| CVE-2024-24919 Check Point Quantum Security Gateways Information Disclosure Vulnerability Ransomware | Check Point Quantum Security Gateways Information Disclosure Vulnerability Ransomware | 8.6 | 100.0% | 2024-05-30 | 2024-06-20 |
| CVE-2023-43208 NextGen Healthcare Mirth Connect Deserialization of Untrusted Data Vulnerability Ransomware | NextGen Healthcare Mirth Connect Deserialization of Untrusted Data Vulnerability Ransomware | 9.8 | 82.7% | 2024-05-20 | 2024-06-10 |
| CVE-2024-30051 Microsoft DWM Core Library Privilege Escalation Vulnerability Ransomware | Microsoft DWM Core Library Privilege Escalation Vulnerability Ransomware | 7.8 | 5.7% | 2024-05-14 | 2024-06-04 |
| CVE-2024-3400 Palo Alto Networks PAN-OS Command Injection Vulnerability Ransomware | Palo Alto Networks PAN-OS Command Injection Vulnerability Ransomware | 10.0 | 100.0% | 2024-04-12 | 2024-04-19 |
| CVE-2023-24955 Microsoft SharePoint Server Code Injection Vulnerability Ransomware | Microsoft SharePoint Server Code Injection Vulnerability Ransomware | 7.2 | 85.0% | 2024-03-26 | 2024-04-16 |
| CVE-2021-44529 Ivanti Endpoint Manager Cloud Service Appliance (EPM CSA) Code Injection Vulnerability Ransomware | Ivanti Endpoint Manager Cloud Service Appliance (EPM CSA) Code Injection Vulnerability Ransomware | 9.8 | 99.1% | 2024-03-25 | 2024-04-15 |
| CVE-2023-48788 Fortinet FortiClient EMS SQL Injection Vulnerability Ransomware | Fortinet FortiClient EMS SQL Injection Vulnerability Ransomware | 9.3 | 98.4% | 2024-03-25 | 2024-04-15 |
| CVE-2024-27198 JetBrains TeamCity Authentication Bypass Vulnerability Ransomware | JetBrains TeamCity Authentication Bypass Vulnerability Ransomware | 9.8 | 99.9% | 2024-03-07 | 2024-03-28 |
| CVE-2024-21338 Microsoft Windows Kernel Exposed IOCTL with Insufficient Access Control Vulnerability Ransomware | Microsoft Windows Kernel Exposed IOCTL with Insufficient Access Control Vulnerability Ransomware | 7.8 | 59.8% | 2024-03-04 | 2024-03-25 |
| CVE-2024-1709 ConnectWise ScreenConnect Authentication Bypass Vulnerability Ransomware | ConnectWise ScreenConnect Authentication Bypass Vulnerability Ransomware | 10.0 | 100.0% | 2024-02-22 | 2024-02-29 |
| CVE-2020-3259 Cisco ASA and FTD Information Disclosure Vulnerability Ransomware | Cisco ASA and FTD Information Disclosure Vulnerability Ransomware | 7.5 | 71.8% | 2024-02-15 | 2024-03-07 |
| CVE-2024-21412 Microsoft Windows Internet Shortcut Files Security Feature Bypass Vulnerability Ransomware | Microsoft Windows Internet Shortcut Files Security Feature Bypass Vulnerability Ransomware | 8.1 | 99.4% | 2024-02-13 | 2024-03-05 |
| CVE-2024-21762 Fortinet FortiOS Out-of-Bound Write Vulnerability Ransomware | Fortinet FortiOS Out-of-Bound Write Vulnerability Ransomware | 9.6 | 83.4% | 2024-02-09 | 2024-02-16 |
| CVE-2024-21893 Ivanti Connect Secure, Policy Secure, and Neurons Server-Side Request Forgery (SSRF) Vulnerability Ransomware | Ivanti Connect Secure, Policy Secure, and Neurons Server-Side Request Forgery (SSRF) Vulnerability Ransomware | 8.2 | 100.0% | 2024-01-31 | 2024-02-02 |
| CVE-2023-22527 Atlassian Confluence Data Center and Server Template Injection Vulnerability Ransomware | Atlassian Confluence Data Center and Server Template Injection Vulnerability Ransomware | 10.0 | 100.0% | 2024-01-24 | 2024-02-14 |
| CVE-2023-35082 Ivanti Endpoint Manager Mobile (EPMM) and MobileIron Core Authentication Bypass Vulnerability Ransomware | Ivanti Endpoint Manager Mobile (EPMM) and MobileIron Core Authentication Bypass Vulnerability Ransomware | 10.0 | 100.0% | 2024-01-18 | 2024-02-08 |
| CVE-2023-29357 Microsoft SharePoint Server Privilege Escalation Vulnerability Ransomware | Microsoft SharePoint Server Privilege Escalation Vulnerability Ransomware | 9.8 | 100.0% | 2024-01-10 | 2024-01-31 |
| CVE-2023-46805 Ivanti Connect Secure and Policy Secure Authentication Bypass Vulnerability Ransomware | Ivanti Connect Secure and Policy Secure Authentication Bypass Vulnerability Ransomware | 8.2 | 100.0% | 2024-01-10 | 2024-01-22 |
| CVE-2024-21887 Ivanti Connect Secure and Policy Secure Command Injection Vulnerability Ransomware | Ivanti Connect Secure and Policy Secure Command Injection Vulnerability Ransomware | 9.1 | 100.0% | 2024-01-10 | 2024-01-22 |
Frequently Asked Questions
What does known ransomware use mean in the KEV catalog?→
Each KEV entry has a knownRansomwareCampaignUse field. CISA sets it to Known when the vulnerability is known to have been leveraged as part of a ransomware campaign, and to Unknown when CISA lacks confirmation that the vulnerability has been used for ransomware. An Unknown value means confirmation is missing, not that ransomware use is ruled out.
How many KEV vulnerabilities are used in ransomware attacks?→
As of October 12, 2026, CISA marks 361 of the 1,739 entries in the KEV catalog (21%) as known to be used in ransomware campaigns. 30 of the 303 vulnerabilities CISA added to the KEV catalog in the 12 months to October 12, 2026 are marked as known to be used in ransomware campaigns.
Which vendors have the most vulnerabilities used in ransomware?→
Microsoft has the most ransomware-linked KEV entries (117), followed by Fortinet (14) and Oracle (13), as of October 12, 2026.
Related
Data: CISA Known Exploited Vulnerabilities catalog (CC0), CVE records from the CVE Program, EPSS by FIRST (first.org/epss). This site is not endorsed or certified by CISA or FIRST.