CVE Intelligence
Home / Threat intelligence

Ransomware Intelligence

CISA flags a vulnerability as "used by ransomware" only when a campaign is confirmed. These are flaws extortion groups have already exploited: fixing them first removes the most concrete risk.

361
CVEs used by ransomware · 21% of the KEV catalog
3
added in the last 90 days
173
critical
152
victims posted (30 days)
409
groups tracked

Vendors most exploited by ransomware

Most common weaknesses (CWE)

By year added to KEV

Most active groups (30 days)

Victims posted on leak sites, according to ransomware.live. Victim names are not displayed.

GroupVictimsLast activity
N0n 43 12h
qilin 20 7h
Wallstreet 14 9h
lockbit5 8 12h
incransom 7 5h
iah6477 7 11h
akira 6 15h
interlock 6 3d
play 5 3d
AuditTeam 3 2d
Dark Project 3 3d
Emperador 3 19h
All groups →

Most affected countries (30 days)

  • United States38
  • Sweden10
  • Brazil9
  • South Korea9
  • United Kingdom7
  • Singapore4
  • Spain4
  • Japan4
  • India4
  • Germany3

Most affected sectors (30 days)

  • Transportation29
  • Professional Services23
  • Manufacturing16
  • Healthcare14
  • Other12
  • Technology12
  • Retail & E-Commerce9
  • Financial Services5
  • Agriculture and Food Production5
  • Energy & Utilities4

Groups and the CVEs they exploit

clop 5akira 3alphv 3conti 3hive 3play 3medusa 2vicesociety 2atomsilo 1blackbyte 1blackshadow 1BrainCipher 1esxiargs 1frag 1handala 1icefire 1incransom 1karma 1lockbit 1maze 1nightsky 1nightspire 1nokoyawa 1revil 1reynolds 1underground 1

CVEs used in ransomware campaigns

Severity
Clear

132 result(s)

CVE-2022-26501 Critical · 9.8 KEV Urgent · 72 Ransomware CWE-306 Mar 17, 2022
Veeam Backup & Replication Remote Code Execution Vulnerability
Veeam Backup & Replication 10.x and 11.x has Incorrect Access Control (issue 1 of 2).
CVE-2022-26500 High · 8.8 KEV High · 65 Ransomware CWE-22 Mar 17, 2022
Veeam Backup & Replication Remote Code Execution Vulnerability
Improper limitation of path names in Veeam Backup & Replication 9.5U3, 9.5U4,10.x, and 11.x allows remote authenticated users access to internal API functions that allows attackers to upload and execute arbitrary code.
CVE-2022-44698 Medium · 5.4 KEV High · 63 Ransomware Dec 13, 2022
Microsoft Defender SmartScreen Security Feature Bypass Vulnerability
Windows SmartScreen Security Feature Bypass Vulnerability
CVE-2022-42475 Critical · 9.8 KEV Urgent · 89 Public exploit Ransomware CWE-787 Jan 2, 2023
Fortinet FortiOS Heap-Based Buffer Overflow Vulnerability
A heap-based buffer overflow vulnerability [CWE-122] in FortiOS SSL-VPN 7.2.0 through 7.2.2, 7.0.0 through 7.0.8, 6.4.0 through 6.4.10, 6.2.0 through 6.2.11, 6.0.15 and earlier and FortiProxy SSL-VPN 7.2.0 through 7.2.1, 7.0.7 and earlier may allow a remote unauthenticated attacker to execute arbitrary code or commands via specifically crafted requests.
CVE-2022-41073 High · 7.8 KEV High · 63 Ransomware CWE-787 Nov 9, 2022
Microsoft Windows Print Spooler Privilege Escalation Vulnerability
Windows Print Spooler Elevation of Privilege Vulnerability
CVE-2022-41091 Medium · 5.4 KEV High · 60 Ransomware CWE-863 Nov 9, 2022
Microsoft Windows Mark of the Web (MOTW) Security Feature Bypass Vulnerability
Windows Mark of the Web Security Feature Bypass Vulnerability
CVE-2018-19320 High · 7.8 KEV Urgent · 70 Public exploit Ransomware Dec 21, 2018
GIGABYTE Multiple Products Unspecified Vulnerability
The GDrv low-level driver in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, XTREME GAMING ENGINE before 1.26, and OC GURU II v2.08 exposes ring0 memcpy-like functionality that could allow a local attacker to take complete control of the affected system.
CVE-2018-19321 High · 7.8 KEV Urgent · 70 Public exploit Ransomware Dec 21, 2018
GIGABYTE Multiple Products Privilege Escalation Vulnerability
The GPCIDrv and GDrv low-level drivers in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, XTREME GAMING ENGINE before 1.26, and OC GURU II v2.08 expose functionality to read and write arbitrary physical memory. This could be leveraged by a local attacker to elevate privileges.
CVE-2018-19322 High · 7.8 KEV High · 63 Ransomware CWE-749 Dec 21, 2018
GIGABYTE Multiple Products Code Execution Vulnerability
The GPCIDrv and GDrv low-level drivers in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, XTREME GAMING ENGINE before 1.26, and OC GURU II v2.08 expose functionality to read/write data from/to IO ports. This could be leveraged in a number of ways to ultimately run code with elevated privileges.
CVE-2018-19323 Critical · 9.8 KEV Urgent · 75 Public exploit Ransomware Dec 21, 2018
GIGABYTE Multiple Products Privilege Escalation Vulnerability
The GDrv low-level driver in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, XTREME GAMING ENGINE before 1.26, and OC GURU II v2.08 exposes functionality to read and write Machine Specific Registers (MSRs).
CVE-2020-3153 Medium · 6.5 KEV Urgent · 81 Public exploit Ransomware CWE-427 Feb 19, 2020
Cisco AnyConnect Secure Mobility Client for Windows Uncontrolled Search Path Vulnerability
A vulnerability in the installer component of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated local attacker to copy user-supplied files to system level directories with system level privileges. The vulnerability is due to the incorrect handling of directory paths. An attacker could exploit this vulnerability by creating a malicious file and copying the file to a system directory. An exploit could allow the attacker to copy malicious files to arbitrary locations with system level privileges. This could include DLL pre-loading, DLL hijacking, and other related attacks. To exploit this vulnerability, the attacker needs valid credentials on the Windows system.
CVE-2020-3433 High · 7.8 KEV Urgent · 83 Public exploit Ransomware CWE-427 Aug 17, 2020
Cisco AnyConnect Secure Mobility Client for Windows DLL Hijacking Vulnerability
A vulnerability in the interprocess communication (IPC) channel of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local attacker to perform a DLL hijacking attack. To exploit this vulnerability, the attacker would need to have valid credentials on the Windows system. The vulnerability is due to insufficient validation of resources that are loaded by the application at run time. An attacker could exploit this vulnerability by sending a crafted IPC message to the AnyConnect process. A successful exploit could allow the attacker to execute arbitrary code on the affected machine with SYSTEM privileges. To exploit this vulnerability, the attacker would need to have valid credentials on the Windows system.
CVE-2022-41352 Critical · 9.8 KEV Urgent · 93 Public exploit Ransomware CWE-22 Sep 25, 2022
Synacor Zimbra Collaboration Suite (ZCS) Arbitrary File Upload Vulnerability
An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0. An attacker can upload arbitrary files through amavis via a cpio loophole (extraction to /opt/zimbra/jetty/webapps/zimbra/public) that can lead to incorrect access to any other user accounts. Zimbra recommends pax over cpio. Also, pax is in the prerequisites of Zimbra on Ubuntu; however, pax is no longer part of a default Red Hat installation after RHEL 6 (or CentOS 6). Once pax is installed, amavis automatically prefers it over cpio.
CVE-2022-40684 Critical · 9.8 KEV Urgent · 93 Public exploit Ransomware CWE-287 Oct 18, 2022
Fortinet Multiple Products Authentication Bypass Vulnerability
An authentication bypass using an alternate path or channel [CWE-288] in Fortinet FortiOS version 7.2.0 through 7.2.1 and 7.0.0 through 7.0.6, FortiProxy version 7.2.0 and version 7.0.0 through 7.0.6 and FortiSwitchManager version 7.2.0 and 7.0.0 allows an unauthenticated atttacker to perform operations on the administrative interface via specially crafted HTTP or HTTPS requests.
CVE-2022-41040 High · 8.8 KEV Urgent · 94 Public exploit Ransomware CWE-918 Oct 2, 2022
Microsoft Exchange Server Server-Side Request Forgery Vulnerability
Microsoft Exchange Server Elevation of Privilege Vulnerability
CVE-2022-41082 High · 8.0 KEV Urgent · 94 Public exploit Ransomware CWE-502 Oct 2, 2022
Microsoft Exchange Server Remote Code Execution Vulnerability
Microsoft Exchange Server Remote Code Execution Vulnerability
CVE-2022-37969 High · 7.8 KEV Urgent · 72 Public exploit Ransomware CWE-787 Sep 13, 2022
Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation Vulnerability
Windows Common Log File System Driver Elevation of Privilege Vulnerability
CVE-2018-13374 Medium · 4.3 KEV Urgent · 77 Public exploit Ransomware CWE-732 Jan 22, 2019
Fortinet FortiOS and FortiADC Improper Access Control Vulnerability
A Improper Access Control in Fortinet FortiOS 6.0.2, 5.6.7 and before, FortiADC 6.1.0, 6.0.0 to 6.0.1, 5.4.0 to 5.4.4 allows attacker to obtain the LDAP server login credentials configured in FortiGate via pointing a LDAP server connectivity test request to a rogue LDAP server instead of the configured one.
CVE-2018-6530 Critical · 9.8 KEV Urgent · 77 Public exploit Ransomware CWE-78 Mar 6, 2018
D-Link Multiple Routers OS Command Injection Vulnerability
OS command injection vulnerability in soap.cgi (soapcgi_main in cgibin) in D-Link DIR-880L DIR-880L_REVA_FIRMWARE_PATCH_1.08B04 and previous versions, DIR-868L DIR868LA1_FW112b04 and previous versions, DIR-65L DIR-865L_REVA_FIRMWARE_PATCH_1.08.B01 and previous versions, and DIR-860L DIR860LA1_FW110b04 and previous versions allows remote attackers to execute arbitrary OS commands via the service parameter.
CVE-2022-27593 Critical · 9.1 KEV Urgent · 77 Public exploit Ransomware CWE-610 Sep 8, 2022
QNAP Photo Station Externally Controlled Reference Vulnerability
An externally controlled reference to a resource vulnerability has been reported to affect QNAP NAS running Photo Station. If exploited, This could allow an attacker to modify system files. We have already fixed the vulnerability in the following versions: QTS 5.0.1: Photo Station 6.1.2 and later QTS 5.0.0/4.5.x: Photo Station 6.0.22 and later QTS 4.3.6: Photo Station 5.7.18 and later QTS 4.3.3: Photo Station 5.4.15 and later QTS 4.2.6: Photo Station 5.2.14 and later
CVE-2022-2294 High · 8.8 KEV High · 66 Ransomware CWE-787 Jul 27, 2022
WebRTC Heap Buffer Overflow Vulnerability
Heap buffer overflow in WebRTC in Google Chrome prior to 103.0.5060.114 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVE-2022-26352 Critical · 9.8 KEV Urgent · 89 Public exploit Ransomware Jul 17, 2022
dotCMS Unrestricted Upload of File Vulnerability
An issue was discovered in the ContentResource API in dotCMS 3.0 through 22.02. Attackers can craft a multipart form request to post a file whose filename is not initially sanitized. This allows directory traversal, in which the file is saved outside of the intended storage location. If anonymous content creation is enabled, this allows an unauthenticated attacker to upload an executable file, such as a .jsp file, that can lead to remote code execution.
CVE-2022-37042 Critical · 9.8 KEV Urgent · 93 Public exploit Ransomware CWE-22 Aug 12, 2022
Synacor Zimbra Collaboration Suite (ZCS) Authentication Bypass Vulnerability
Zimbra Collaboration Suite (ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it. By bypassing authentication (i.e., not having an authtoken), an attacker can upload arbitrary files to the system, leading to directory traversal and remote code execution. NOTE: this issue exists because of an incomplete fix for CVE-2022-27925.
CVE-2022-27925 High · 7.2 KEV Urgent · 89 Public exploit Ransomware CWE-22 Apr 20, 2022
Synacor Zimbra Collaboration Suite (ZCS) Arbitrary File Upload Vulnerability
Zimbra Collaboration (aka ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it. An authenticated user with administrator rights has the ability to upload arbitrary files to the system, leading to directory traversal.
CVE-2022-30333 High · 7.5 KEV Urgent · 87 Public exploit Ransomware CWE-22 May 9, 2022
RARLAB UnRAR Directory Traversal Vulnerability
RARLAB UnRAR before 6.12 on Linux and UNIX allows directory traversal to write to files during an extract (aka unpack) operation, as demonstrated by creating a ~/.ssh/authorized_keys file. NOTE: WinRAR and Android RAR are unaffected.

Sources: CISA KEV (knownRansomwareCampaignUse field) and ransomware.live (groups, TTPs and victim counts). The absence of a KEV flag does not mean a flaw is not used by ransomware.