CVE Intelligence
Home / Threat intelligence

Ransomware Intelligence

CISA flags a vulnerability as "used by ransomware" only when a campaign is confirmed. These are flaws extortion groups have already exploited: fixing them first removes the most concrete risk.

361
CVEs used by ransomware · 21% of the KEV catalog
3
added in the last 90 days
173
critical
121
victims posted (30 days)
408
groups tracked

Vendors most exploited by ransomware

Most common weaknesses (CWE)

By year added to KEV

Most active groups (30 days)

Victims posted on leak sites, according to ransomware.live. Victim names are not displayed.

GroupVictimsLast activity
N0n 41 13h
Wallstreet 13 1d
qilin 9 1d
interlock 6 3d
play 5 2d
akira 3 1d
AuditTeam 3 2d
Dark Project 3 3d
lockbit5 3 1d
Emperador 3 8h
everest 3 2d
iah6477 3 6h
All groups →

Most affected countries (30 days)

  • United States25
  • Sweden10
  • Brazil8
  • South Korea8
  • United Kingdom5
  • Singapore4
  • India4
  • Spain3
  • Germany3
  • Japan3

Most affected sectors (30 days)

  • Transportation28
  • Professional Services19
  • Healthcare13
  • Manufacturing11
  • Other10
  • Retail & E-Commerce8
  • Technology7
  • Financial Services3
  • Energy & Utilities3
  • Hospitality2

Groups and the CVEs they exploit

clop 5akira 3alphv 3conti 3hive 3play 3medusa 2vicesociety 2atomsilo 1blackbyte 1blackshadow 1BrainCipher 1esxiargs 1frag 1handala 1icefire 1incransom 1karma 1lockbit 1maze 1nightsky 1nightspire 1nokoyawa 1revil 1reynolds 1underground 1

CVEs used in ransomware campaigns

Severity
Clear

12 result(s)

CVE-2025-22457 Critical · 9.8 KEV Urgent · 88 Public exploit Ransomware CWE-787 Apr 3, 2025
Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability
A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.6, Ivanti Policy Secure before version 22.7R1.4, and Ivanti ZTA Gateways before version 22.8R2.2 allows a remote unauthenticated attacker to achieve remote code execution.
CVE-2025-0282 Critical · 9.0 KEV Urgent · 88 Public exploit Ransomware CWE-787 Jan 8, 2025
Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability
A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7R1.2, and Ivanti Neurons for ZTA gateways before version 22.7R2.3 allows a remote unauthenticated attacker to achieve remote code execution.
CVE-2021-44529 Critical · 9.8 KEV Urgent · 93 Public exploit Ransomware CWE-94 Dec 8, 2021
Ivanti Endpoint Manager Cloud Service Appliance (EPM CSA) Code Injection Vulnerability
A code injection vulnerability in the Ivanti EPM Cloud Services Appliance (CSA) allows an unauthenticated user to execute arbitrary code with limited permissions (nobody).
CVE-2024-21893 High · 8.2 KEV Urgent · 89 Public exploit Ransomware CWE-918 Jan 31, 2024
Ivanti Connect Secure, Policy Secure, and Neurons Server-Side Request Forgery (SSRF) Vulnerability
A server-side request forgery vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) and Ivanti Neurons for ZTA allows an attacker to access certain restricted resources without authentication.
CVE-2023-35082 Critical · 9.8 KEV Urgent · 83 Public exploit Ransomware CWE-287 Aug 15, 2023
Ivanti Endpoint Manager Mobile (EPMM) and MobileIron Core Authentication Bypass Vulnerability
An authentication bypass vulnerability in Ivanti EPMM 11.10 and older, allows unauthorized users to access restricted functionality or resources of the application without proper authentication. This vulnerability is unique to CVE-2023-35078 announced earlier.
CVE-2024-21887 Critical · 9.1 KEV Urgent · 90 Public exploit Ransomware CWE-77 Jan 12, 2024
Ivanti Connect Secure and Policy Secure Command Injection Vulnerability
A command injection vulnerability in web components of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) allows an authenticated administrator to send specially crafted requests and execute arbitrary commands on the appliance.
CVE-2023-46805 High · 8.2 KEV Urgent · 99 Public exploit Ransomware CWE-287 Jan 12, 2024
Ivanti Connect Secure and Policy Secure Authentication Bypass Vulnerability
An authentication bypass vulnerability in the web component of Ivanti ICS 9.x, 22.x and Ivanti Policy Secure allows a remote attacker to access restricted resources by bypassing control checks.
CVE-2023-38035 Critical · 9.8 KEV Urgent · 93 Public exploit Ransomware CWE-863 Aug 21, 2023
Ivanti Sentry Authentication Bypass Vulnerability
A security vulnerability in MICS Admin Portal in Ivanti MobileIron Sentry versions 9.18.0 and below, which may allow an attacker to bypass authentication controls on the administrative interface due to an insufficiently restrictive Apache HTTPD configuration.
CVE-2023-35078 Critical · 9.8 KEV Urgent · 83 Public exploit Ransomware CWE-287 Jul 25, 2023
Ivanti Endpoint Manager Mobile Authentication Bypass Vulnerability
An authentication bypass vulnerability in Ivanti EPMM allows unauthorized users to access restricted functionality or resources of the application without proper authentication.
CVE-2019-11539 High · 7.2 KEV Urgent · 86 Public exploit Ransomware CWE-78 Apr 25, 2019
Ivanti Pulse Connect Secure and Policy Secure Command Injection Vulnerability
In Pulse Secure Pulse Connect Secure version 9.0RX before 9.0R3.4, 8.3RX before 8.3R7.1, 8.2RX before 8.2R12.1, and 8.1RX before 8.1R15.1 and Pulse Policy Secure version 9.0RX before 9.0R3.2, 5.4RX before 5.4R7.1, 5.3RX before 5.3R12.1, 5.2RX before 5.2R12.1, and 5.1RX before 5.1R15.1, the admin web interface allows an authenticated attacker to inject and execute commands.
CVE-2019-11510 Critical · 10.0 KEV Urgent · 100 Public exploit Ransomware CWE-22 May 8, 2019
Ivanti Pulse Connect Secure Arbitrary File Read Vulnerability
In Pulse Secure Pulse Connect Secure (PCS) 8.2 before 8.2R12.1, 8.3 before 8.3R7.1, and 9.0 before 9.0R3.4, an unauthenticated remote attacker can send a specially crafted URI to perform an arbitrary file reading vulnerability .
CVE-2021-22893 Critical · 10.0 KEV Urgent · 73 Ransomware CWE-416 Apr 23, 2021
Ivanti Pulse Connect Secure Use-After-Free Vulnerability
Pulse Connect Secure 9.0R3/9.1R1 and higher is vulnerable to an authentication bypass vulnerability exposed by the Windows File Share Browser and Pulse Secure Collaboration features of Pulse Connect Secure that can allow an unauthenticated user to perform remote arbitrary code execution on the Pulse Connect Secure gateway. This vulnerability has been exploited in the wild.

Sources: CISA KEV (knownRansomwareCampaignUse field) and ransomware.live (groups, TTPs and victim counts). The absence of a KEV flag does not mean a flaw is not used by ransomware.