CVE Intelligence
Home / Threat intelligence

Ransomware Intelligence

CISA flags a vulnerability as "used by ransomware" only when a campaign is confirmed. These are flaws extortion groups have already exploited: fixing them first removes the most concrete risk.

361
CVEs used by ransomware · 21% of the KEV catalog
3
added in the last 90 days
173
critical
121
victims posted (30 days)
408
groups tracked

Vendors most exploited by ransomware

Most common weaknesses (CWE)

By year added to KEV

Most active groups (30 days)

Victims posted on leak sites, according to ransomware.live. Victim names are not displayed.

GroupVictimsLast activity
N0n 41 13h
Wallstreet 13 1d
qilin 9 1d
interlock 6 3d
play 5 2d
akira 3 1d
AuditTeam 3 2d
Dark Project 3 3d
lockbit5 3 1d
Emperador 3 8h
everest 3 2d
iah6477 3 6h
All groups →

Most affected countries (30 days)

  • United States25
  • Sweden10
  • Brazil8
  • South Korea8
  • United Kingdom5
  • Singapore4
  • India4
  • Spain3
  • Germany3
  • Japan3

Most affected sectors (30 days)

  • Transportation28
  • Professional Services19
  • Healthcare13
  • Manufacturing11
  • Other10
  • Retail & E-Commerce8
  • Technology7
  • Financial Services3
  • Energy & Utilities3
  • Hospitality2

Groups and the CVEs they exploit

clop 5akira 3alphv 3conti 3hive 3play 3medusa 2vicesociety 2atomsilo 1blackbyte 1blackshadow 1BrainCipher 1esxiargs 1frag 1handala 1icefire 1incransom 1karma 1lockbit 1maze 1nightsky 1nightspire 1nokoyawa 1revil 1reynolds 1underground 1

CVEs used in ransomware campaigns

Severity
Clear

15 result(s)

CVE-2026-15410 High · 7.2 KEV Urgent · 71 Public exploit Ransomware CWE-94 Jul 14, 2026
SonicWall SMA1000 Appliances Code Injection Vulnerability
Post-authentication improper control of generation of code ('Code Injection') vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) which in specific conditions could potentially enable a remote authenticated attacker as administrator to execute arbitrary OS commands.
CVE-2025-49704 High · 8.8 KEV Urgent · 78 Public exploit Ransomware CWE-94 Jul 8, 2025
Microsoft SharePoint Code Injection Vulnerability
Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
CVE-2025-3248 Critical · 9.8 KEV Urgent · 93 Public exploit Ransomware CWE-94 Apr 7, 2025
Langflow Missing Authentication Vulnerability
Langflow versions prior to 1.3.0 are susceptible to code injection in the /api/v1/validate/code endpoint. A remote and unauthenticated attacker can send crafted HTTP requests to execute arbitrary code.
CVE-2024-23692 Critical · 9.8 KEV Urgent · 93 Public exploit Ransomware CWE-94 May 31, 2024
Rejetto HTTP File Server Improper Neutralization of Special Elements Used in a Template Engine Vulnerability
Rejetto HTTP File Server, up to and including version 2.3m, is vulnerable to a template injection vulnerability. This vulnerability allows a remote, unauthenticated attacker to execute arbitrary commands on the affected system by sending a specially crafted HTTP request. As of the CVE assignment date, Rejetto HFS 2.3m is no longer supported.
CVE-2023-24955 High · 7.2 KEV Urgent · 84 Public exploit Ransomware CWE-94 May 9, 2023
Microsoft SharePoint Server Code Injection Vulnerability
Microsoft SharePoint Server Remote Code Execution Vulnerability
CVE-2021-44529 Critical · 9.8 KEV Urgent · 93 Public exploit Ransomware CWE-94 Dec 8, 2021
Ivanti Endpoint Manager Cloud Service Appliance (EPM CSA) Code Injection Vulnerability
A code injection vulnerability in the Ivanti EPM Cloud Services Appliance (CSA) allows an unauthenticated user to execute arbitrary code with limited permissions (nobody).
CVE-2023-3519 Critical · 9.8 KEV Urgent · 100 Public exploit Ransomware CWE-94 Jul 19, 2023
Citrix NetScaler ADC and NetScaler Gateway Code Injection Vulnerability
Unauthenticated remote code execution
CVE-2017-7494 Critical · 9.8 KEV Urgent · 93 Public exploit Ransomware CWE-94 May 30, 2017
Samba Remote Code Execution Vulnerability
Samba since version 3.5.0 and before 4.6.4, 4.5.10 and 4.4.14 is vulnerable to remote code execution vulnerability, allowing a malicious client to upload a shared library to a writable share, and then cause the server to load and execute it.
CVE-2022-41223 Medium · 6.8 KEV High · 62 Ransomware CWE-94 Nov 21, 2022
Mitel MiVoice Connect Code Injection Vulnerability
The Director database component of MiVoice Connect through 19.3 (22.22.6100.0) could allow an authenticated attacker to conduct a code-injection attack via crafted data due to insufficient restrictions on the database data type.
CVE-2022-22954 Critical · 9.8 KEV Urgent · 93 Public exploit Ransomware CWE-94 Apr 11, 2022
VMware Workspace ONE Access and Identity Manager Server-Side Template Injection Vulnerability
VMware Workspace ONE Access and Identity Manager contain a remote code execution vulnerability due to server-side template injection. A malicious actor with network access can trigger a server-side template injection that may result in remote code execution.
CVE-2018-7602 Critical · 9.8 KEV Urgent · 82 Public exploit Ransomware CWE-94 Jul 19, 2018
Drupal Core Remote Code Execution Vulnerability
A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. This potentially allows attackers to exploit multiple attack vectors on a Drupal site, which could result in the site being compromised. This vulnerability is related to Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-002. Both SA-CORE-2018-002 and this vulnerability are being exploited in the wild.
CVE-2018-1273 Critical · 9.8 KEV Urgent · 77 Public exploit Ransomware CWE-94 Apr 11, 2018
VMware Tanzu Spring Data Commons Property Binder Vulnerability
Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property binder vulnerability caused by improper neutralization of special elements. An unauthenticated remote malicious user (or attacker) can supply specially crafted request parameters against Spring Data REST backed HTTP resources or using Spring Data's projection-based request payload binding hat can lead to a remote code execution attack.
CVE-2012-0158 High · 8.8 KEV Urgent · 96 Public exploit Ransomware CWE-94 Apr 10, 2012
Microsoft MSCOMCTL.OCX Remote Code Execution Vulnerability
The (1) ListView, (2) ListView2, (3) TreeView, and (4) TreeView2 ActiveX controls in MSCOMCTL.OCX in the Common Controls in Microsoft Office 2003 SP3, 2007 SP2 and SP3, and 2010 Gold and SP1; Office 2003 Web Components SP3; SQL Server 2000 SP4, 2005 SP4, and 2008 SP2, SP3, and R2; BizTalk Server 2002 SP1; Commerce Server 2002 SP4, 2007 SP2, and 2009 Gold and R2; Visual FoxPro 8.0 SP1 and 9.0 SP2; and Visual Basic 6.0 Runtime allow remote attackers to execute arbitrary code via a crafted (a) web site, (b) Office document, or (c) .rtf file that triggers "system state" corruption, as exploited in the wild in April 2012, aka "MSCOMCTL.OCX RCE Vulnerability."
CVE-2021-22205 Critical · 10.0 KEV Urgent · 93 Public exploit Ransomware CWE-94 Apr 23, 2021
GitLab Community and Enterprise Editions Remote Code Execution Vulnerability
An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. GitLab was not properly validating image files that were passed to a file parser which resulted in a remote command execution.
CVE-2017-9822 High · 8.8 KEV Urgent · 86 Public exploit Ransomware CWE-94 Jul 20, 2017
DotNetNuke (DNN) Remote Code Execution Vulnerability
DNN (aka DotNetNuke) before 9.1.1 has Remote Code Execution via a cookie, aka "2017-08 (Critical) Possible remote code execution on DNN sites."

Sources: CISA KEV (knownRansomwareCampaignUse field) and ransomware.live (groups, TTPs and victim counts). The absence of a KEV flag does not mean a flaw is not used by ransomware.