Home / Threat intelligence
Ransomware Intelligence
CISA flags a vulnerability as "used by ransomware" only when a campaign is confirmed. These are flaws extortion groups have already exploited: fixing them first removes the most concrete risk.
361
CVEs used by ransomware · 21% of the KEV catalog
3
added in the last 90 days
173
critical
121
victims posted (30 days)
408
groups tracked
Vendors most exploited by ransomware
Most common weaknesses (CWE)
- CWE-22 · Path Traversal36
- CWE-787 · Out-of-bounds Write27
- CWE-502 · Deserialization of Untrusted Data25
- CWE-94 · Code Injection15
- CWE-287 · Improper Authentication14
- CWE-306 · Missing Authentication for Critical Function14
- CWE-78 · OS Command Injection14
- CWE-59 · Link Following13
- CWE-416 · Use After Free11
- CWE-918 · Server-Side Request Forgery (SSRF)10
Most active groups (30 days)
Victims posted on leak sites, according to ransomware.live. Victim names are not displayed.
Most affected countries (30 days)
- United States25
- Sweden10
- Brazil8
- South Korea8
- United Kingdom5
- Singapore4
- India4
- Spain3
- Germany3
- Japan3
Most affected sectors (30 days)
- Transportation28
- Professional Services19
- Healthcare13
- Manufacturing11
- Other10
- Retail & E-Commerce8
- Technology7
- Financial Services3
- Energy & Utilities3
- Hospitality2
Groups and the CVEs they exploit
clop 5akira 3alphv 3conti 3hive 3play 3medusa 2vicesociety 2atomsilo 1blackbyte 1blackshadow 1BrainCipher 1esxiargs 1frag 1handala 1icefire 1incransom 1karma 1lockbit 1maze 1nightsky 1nightspire 1nokoyawa 1revil 1reynolds 1underground 1CVEs used in ransomware campaigns
27 result(s)
CVE-2025-14733
Critical · 9.8
KEV Urgent · 79 Public exploit Ransomware CWE-787 Dec 18, 2025
WatchGuard Firebox Out of Bounds Write Vulnerability
An Out-of-bounds Write vulnerability in the WatchGuard Fireware OS iked process may allow a remote unauthenticated attacker to execute arbitrary code. This vulnerability affects both the mobile user VPN with IKEv2 and the branch office VPN using IKEv2 when configured with a dynamic gateway peer.
If the Firebox was previously configured with the mobile user VPN with IKEv2 or a branch office VPN using IKEv2 to a dynamic gateway peer, and both of those configurations have since been deleted, that Firebox may still be vulnerable if a branch office VPN to a static gateway peer is still configured.
CVE-2025-22457
Critical · 9.8
KEV Urgent · 88 Public exploit Ransomware CWE-787 Apr 3, 2025
Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability
A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.6, Ivanti Policy Secure before version 22.7R1.4, and Ivanti ZTA Gateways before version 22.8R2.2 allows a remote unauthenticated attacker to achieve remote code execution.
CVE-2025-22225
High · 8.2
KEV High · 60 Ransomware CWE-787 Mar 4, 2025
VMware ESXi Arbitrary Write Vulnerability
VMware ESXi contains an arbitrary write vulnerability. A malicious actor with privileges within the VMX process may trigger an arbitrary kernel write leading to an escape of the sandbox.
CVE-2025-0282
Critical · 9.0
KEV Urgent · 88 Public exploit Ransomware CWE-787 Jan 8, 2025
Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability
A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7R1.2, and Ivanti Neurons for ZTA gateways before version 22.7R2.3 allows a remote unauthenticated attacker to achieve remote code execution.
CVE-2024-30051
High · 7.8
KEV Urgent · 71 Public exploit Ransomware CWE-787 May 14, 2024
Microsoft DWM Core Library Privilege Escalation Vulnerability
Windows DWM Core Library Elevation of Privilege Vulnerability
CVE-2024-21762
Critical · 9.8
KEV Urgent · 79 Public exploit Ransomware CWE-787 Feb 9, 2024
Fortinet FortiOS Out-of-Bound Write Vulnerability
A out-of-bounds write in Fortinet FortiOS versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.0 through 7.0.13, 6.4.0 through 6.4.14, 6.2.0 through 6.2.15, 6.0.0 through 6.0.17, FortiProxy versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.8, 7.0.0 through 7.0.14, 2.0.0 through 2.0.13, 1.2.0 through 1.2.13, 1.1.0 through 1.1.6, 1.0.0 through 1.0.7 allows attacker to execute unauthorized code or commands via specifically crafted requests
CVE-2023-27997
Critical · 9.8
KEV Urgent · 79 Public exploit Ransomware CWE-787 Jun 13, 2023
Fortinet FortiOS and FortiProxy SSL-VPN Heap-Based Buffer Overflow Vulnerability
A heap-based buffer overflow vulnerability [CWE-122] in FortiOS version 7.2.4 and below, version 7.0.11 and below, version 6.4.12 and below, version 6.0.16 and below and FortiProxy version 7.2.3 and below, version 7.0.9 and below, version 2.0.12 and below, version 1.2 all versions, version 1.1 all versions SSL-VPN may allow a remote attacker to execute arbitrary code or commands via specifically crafted requests.
CVE-2023-28252
High · 7.8
KEV Urgent · 84 Public exploit Ransomware CWE-787 Apr 11, 2023
Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation Vulnerability
Windows Common Log File System Driver Elevation of Privilege Vulnerability
CVE-2023-23376
High · 7.8
KEV High · 65 Ransomware CWE-787 Feb 14, 2023
Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation Vulnerability
Windows Common Log File System Driver Elevation of Privilege Vulnerability
CVE-2022-42475
Critical · 9.8
KEV Urgent · 89 Public exploit Ransomware CWE-787 Jan 2, 2023
Fortinet FortiOS Heap-Based Buffer Overflow Vulnerability
A heap-based buffer overflow vulnerability [CWE-122] in FortiOS SSL-VPN 7.2.0 through 7.2.2, 7.0.0 through 7.0.8, 6.4.0 through 6.4.10, 6.2.0 through 6.2.11, 6.0.15 and earlier and FortiProxy SSL-VPN 7.2.0 through 7.2.1, 7.0.7 and earlier may allow a remote unauthenticated attacker to execute arbitrary code or commands via specifically crafted requests.
CVE-2022-41073
High · 7.8
KEV High · 63 Ransomware CWE-787 Nov 9, 2022
Microsoft Windows Print Spooler Privilege Escalation Vulnerability
Windows Print Spooler Elevation of Privilege Vulnerability
CVE-2022-37969
High · 7.8
KEV Urgent · 72 Public exploit Ransomware CWE-787 Sep 13, 2022
Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation Vulnerability
Windows Common Log File System Driver Elevation of Privilege Vulnerability
CVE-2022-2294
High · 8.8
KEV High · 66 Ransomware CWE-787 Jul 27, 2022
WebRTC Heap Buffer Overflow Vulnerability
Heap buffer overflow in WebRTC in Google Chrome prior to 103.0.5060.114 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVE-2022-24521
High · 7.8
KEV Urgent · 71 Public exploit Ransomware CWE-787 Apr 15, 2022
Microsoft Windows CLFS Driver Privilege Escalation Vulnerability
Windows Common Log File System Driver Elevation of Privilege Vulnerability
CVE-2016-0189
High · 7.5
KEV Urgent · 86 Public exploit Ransomware CWE-787 May 10, 2016
Microsoft Internet Explorer Memory Corruption Vulnerability
The Microsoft (1) JScript 5.8 and (2) VBScript 5.7 and 5.8 engines, as used in Internet Explorer 9 through 11 and other products, allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," a different vulnerability than CVE-2016-0187.
CVE-2019-11043
Critical · 9.8
KEV Urgent · 90 Public exploit Ransomware CWE-787 Oct 28, 2019
PHP FastCGI Process Manager (FPM) Buffer Overflow Vulnerability
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it is possible to cause FPM module to write past allocated buffers into the space reserved for FCGI protocol data, thus opening the possibility of remote code execution.
CVE-2008-2992
High · 7.8
KEV Urgent · 86 Public exploit Ransomware CWE-787 Nov 4, 2008
Adobe Reader and Acrobat Input Validation Vulnerability
Stack-based buffer overflow in Adobe Acrobat and Reader 8.1.2 and earlier allows remote attackers to execute arbitrary code via a PDF file that calls the util.printf JavaScript function with a crafted format string argument, a related issue to CVE-2008-1104.
CVE-2018-8174
High · 7.5
KEV Urgent · 84 Public exploit Ransomware CWE-787 May 9, 2018
Microsoft Windows VBScript Engine Out-of-Bounds Write Vulnerability
A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka "Windows VBScript Engine Remote Code Execution Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers.
CVE-2022-21882
High · 7.8
KEV Urgent · 84 Public exploit Ransomware CWE-787 Jan 11, 2022
Microsoft Win32k Privilege Escalation Vulnerability
Win32k Elevation of Privilege Vulnerability
CVE-2018-13383
Medium · 6.5
KEV High · 63 Ransomware CWE-787 May 29, 2019
Fortinet FortiOS and FortiProxy Out-of-bounds Write
A heap buffer overflow in Fortinet FortiOS 6.0.0 through 6.0.4, 5.6.0 through 5.6.10, 5.4.0 through 5.4.12, 5.2.14 and earlier and FortiProxy 2.0.0, 1.2.8 and earlier in the SSL VPN web portal may cause the SSL VPN web service termination for logged in users due to a failure to properly handle javascript href data when proxying webpages.
CVE-2019-5544
Critical · 9.8
KEV Urgent · 77 Public exploit Ransomware CWE-787 Dec 6, 2019
VMware ESXi and Horizon DaaS OpenSLP Heap-Based Buffer Overflow Vulnerability
OpenSLP as used in ESXi and the Horizon DaaS appliances has a heap overwrite issue. VMware has evaluated the severity of this issue to be in the Critical severity range with a maximum CVSSv3 base score of 9.8.
CVE-2021-35211
Critical · 10.0
KEV Urgent · 74 Public exploit Ransomware CWE-787 Jul 14, 2021
SolarWinds Serv-U Remote Code Execution Vulnerability
Microsoft discovered a remote code execution (RCE) vulnerability in the SolarWinds Serv-U product utilizing a Remote Memory Escape Vulnerability. If exploited, a threat actor may be able to gain privileged access to the machine hosting Serv-U Only. SolarWinds Serv-U Managed File Transfer and Serv-U Secure FTP for Windows before 15.2.3 HF2 are affected by this vulnerability.
CVE-2020-0968
High · 7.5
KEV High · 66 Ransomware CWE-787 Apr 15, 2020
Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability
A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2020-0970.
CVE-2019-1367
High · 7.5
KEV High · 66 Ransomware CWE-787 Sep 23, 2019
Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability
A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-1221.
CVE-2018-0802
High · 7.8
KEV Urgent · 76 Ransomware CWE-787 Jan 9, 2018
Microsoft Office Memory Corruption Vulnerability
Equation Editor in Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 allow a remote code execution vulnerability due to the way objects are handled in memory, aka "Microsoft Office Memory Corruption Vulnerability". This CVE is unique from CVE-2018-0797 and CVE-2018-0812.
Sources: CISA KEV (knownRansomwareCampaignUse field) and ransomware.live (groups, TTPs and victim counts). The absence of a KEV flag does not mean a flaw is not used by ransomware.