Home / Threat intelligence
Ransomware Intelligence
CISA flags a vulnerability as "used by ransomware" only when a campaign is confirmed. These are flaws extortion groups have already exploited: fixing them first removes the most concrete risk.
361
CVEs used by ransomware · 21% of the KEV catalog
3
added in the last 90 days
173
critical
246
victims posted (30 days)
410
groups tracked
Vendors most exploited by ransomware
Most common weaknesses (CWE)
- CWE-22 · Path Traversal36
- CWE-787 · Out-of-bounds Write27
- CWE-502 · Deserialization of Untrusted Data25
- CWE-94 · Code Injection15
- CWE-287 · Improper Authentication14
- CWE-306 · Missing Authentication for Critical Function14
- CWE-78 · OS Command Injection14
- CWE-59 · Link Following13
- CWE-416 · Use After Free11
- CWE-918 · Server-Side Request Forgery (SSRF)10
Most active groups (30 days)
Victims posted on leak sites, according to ransomware.live. Victim names are not displayed.
| Group | Victims | Last activity |
|---|---|---|
| N0n | 67 | 8h |
| thegentlemen | 35 | 17h |
| qilin | 22 | 13h |
| Wallstreet | 15 | 1d |
| lockbit5 | 9 | 22h |
| play | 9 | 1d |
| incransom | 7 | 2d |
| iah6477 | 7 | 2d |
| THE SEVEN DEADLY SINS | 7 | 2d |
| everest | 7 | 1d |
| akira | 6 | 2d |
| interlock | 6 | 5d |
Most affected countries (30 days)
- United States79
- Brazil15
- South Korea11
- Sweden10
- United Kingdom8
- Japan6
- Germany5
- Singapore5
- India5
- Thailand5
Most affected sectors (30 days)
- Transportation33
- Professional Services29
- Healthcare28
- Manufacturing28
- Technology23
- Other16
- Retail & E-Commerce11
- Financial Services11
- Agriculture and Food Production8
- Energy & Utilities7
Groups and the CVEs they exploit
clop 5akira 3alphv 3conti 3hive 3play 3medusa 2vicesociety 2atomsilo 1blackbyte 1blackshadow 1BrainCipher 1esxiargs 1frag 1handala 1icefire 1incransom 1karma 1lockbit 1maze 1nightsky 1nightspire 1nokoyawa 1revil 1reynolds 1underground 1CVEs used in ransomware campaigns
14 result(s)
CVE-2026-50751
Critical · 9.3
KEV Urgent · 83 Public exploit Ransomware CWE-287 Jun 8, 2026
Check Point Security Gateway Improper Authentication Vulnerability
A logic flow weakness in Remote Access and Mobile Access certificate validation in deprecated IKEv1 key exchange allows an unauthenticated remote attacker to bypass user authentication and establish a remote access VPN connection without a valid user password.
CVE-2023-27351
High · 7.5
KEV Urgent · 73 Public exploit Ransomware CWE-287 Apr 20, 2023
PaperCut NG/MF Improper Authentication Vulnerability
This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 (Build 63914). Authentication is not required to exploit this vulnerability. The specific flaw exists within the SecurityRequestFilter class. The issue results from improper implementation of the authentication algorithm. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-19226.
CVE-2025-61882
Critical · 9.8
KEV Urgent · 93 Public exploit Ransomware CWE-287 Oct 5, 2025
Oracle E-Business Suite Unspecified Vulnerability
Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component: BI Publisher Integration). Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Concurrent Processing. Successful attacks of this vulnerability can result in takeover of Oracle Concurrent Processing. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
CVE-2025-49706
Medium · 6.5
KEV Urgent · 83 Public exploit Ransomware CWE-287 Jul 8, 2025
Microsoft SharePoint Improper Authentication Vulnerability
Improper authentication in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.
CVE-2024-53704
Critical · 9.8
KEV Urgent · 83 Public exploit Ransomware CWE-287 Jan 9, 2025
SonicWall SonicOS SSLVPN Improper Authentication Vulnerability
An Improper Authentication vulnerability in the SSLVPN authentication mechanism allows a remote attacker to bypass authentication.
CVE-2023-28461
Critical · 9.8
KEV Urgent · 73 Ransomware CWE-287 Mar 15, 2023
Array Networks AG and vxAG ArrayOS Missing Authentication for Critical Function Vulnerability
Array Networks Array AG Series and vxAG (9.4.0.481 and earlier) allow remote code execution. An attacker can browse the filesystem on the SSL VPN gateway using a flags attribute in an HTTP header without authentication. The product could then be exploited through a vulnerable URL. The 2023-03-09 vendor advisory stated "a new Array AG release with the fix will be available soon."
CVE-2024-49039
High · 8.8
KEV Urgent · 71 Public exploit Ransomware CWE-287 Nov 12, 2024
Microsoft Windows Task Scheduler Privilege Escalation Vulnerability
Windows Task Scheduler Elevation of Privilege Vulnerability
CVE-2024-37085
High · 7.2
KEV Urgent · 82 Public exploit Ransomware CWE-287 Jun 25, 2024
VMware ESXi Authentication Bypass Vulnerability
VMware ESXi contains an authentication bypass vulnerability. A malicious actor with sufficient Active Directory (AD) permissions can gain full access to an ESXi host that was previously configured to use AD for user management https://blogs.vmware.com/vsphere/2012/09/joining-vsphere-hosts-to-active-directory.html by re-creating the configured AD group ('ESXi Admins' by default) after it was deleted from AD.
CVE-2023-35082
Critical · 9.8
KEV Urgent · 83 Public exploit Ransomware CWE-287 Aug 15, 2023
Ivanti Endpoint Manager Mobile (EPMM) and MobileIron Core Authentication Bypass Vulnerability
An authentication bypass vulnerability in Ivanti EPMM 11.10 and older, allows unauthorized users to access restricted functionality or resources of the application without proper authentication. This vulnerability is unique to CVE-2023-35078 announced earlier.
CVE-2023-46805
High · 8.2
KEV Urgent · 99 Public exploit Ransomware CWE-287 Jan 12, 2024
Ivanti Connect Secure and Policy Secure Authentication Bypass Vulnerability
An authentication bypass vulnerability in the web component of Ivanti ICS 9.x, 22.x and Ivanti Policy Secure allows a remote attacker to access restricted resources by bypassing control checks.
CVE-2023-35078
Critical · 9.8
KEV Urgent · 83 Public exploit Ransomware CWE-287 Jul 25, 2023
Ivanti Endpoint Manager Mobile Authentication Bypass Vulnerability
An authentication bypass vulnerability in Ivanti EPMM allows unauthorized users to access restricted functionality or resources of the application without proper authentication.
CVE-2022-40684
Critical · 9.8
KEV Urgent · 93 Public exploit Ransomware CWE-287 Oct 18, 2022
Fortinet Multiple Products Authentication Bypass Vulnerability
An authentication bypass using an alternate path or channel [CWE-288] in Fortinet FortiOS version 7.2.0 through 7.2.1 and 7.0.0 through 7.0.6, FortiProxy version 7.2.0 and version 7.0.0 through 7.0.6 and FortiSwitchManager version 7.2.0 and 7.0.0 allows an unauthenticated atttacker to perform operations on the administrative interface via specially crafted HTTP or HTTPS requests.
CVE-2019-0543
High · 7.8
KEV Urgent · 73 Public exploit Ransomware CWE-287 Jan 8, 2019
Microsoft Windows Privilege Escalation Vulnerability
An elevation of privilege vulnerability exists when Windows improperly handles authentication requests, aka "Microsoft Windows Elevation of Privilege Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2019, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers.
CVE-2020-0688
High · 8.8
KEV Urgent · 96 Public exploit Ransomware CWE-287 Feb 11, 2020
Microsoft Exchange Server Validation Key Remote Code Execution Vulnerability
A remote code execution vulnerability exists in Microsoft Exchange software when the software fails to properly handle objects in memory, aka 'Microsoft Exchange Memory Corruption Vulnerability'.
Sources: CISA KEV (knownRansomwareCampaignUse field) and ransomware.live (groups, TTPs and victim counts). The absence of a KEV flag does not mean a flaw is not used by ransomware.