CVE Intelligence
Início / Inteligência de ameaças

Ransomware Intelligence

A CISA marca uma vulnerabilidade como "usada por ransomware" apenas quando há campanha confirmada. Estas são as falhas que grupos de extorsão já exploraram: corrigi-las primeiro reduz o risco mais concreto.

361
CVEs usadas por ransomware · 21% do catálogo KEV
3
incluídas nos últimos 90 dias
173
críticas
121
vítimas divulgadas (30 dias)
408
grupos monitorados

Fabricantes mais explorados por ransomware

Fraquezas (CWE) mais comuns

Por ano de inclusão na KEV

Grupos mais ativos (30 dias)

Vítimas divulgadas em sites de vazamento, segundo o ransomware.live. Não exibimos nomes de vítimas.

GrupoVítimasÚltima atividade
N0n 41 12 h
Wallstreet 13 1 d
qilin 9 1 d
interlock 6 3 d
play 5 2 d
akira 3 23 h
AuditTeam 3 2 d
Dark Project 3 2 d
lockbit5 3 1 d
Emperador 3 7 h
everest 3 2 d
iah6477 3 5 h
Todos os grupos →

Países mais afetados (30 dias)

  • Estados Unidos25
  • Suécia10
  • Brasil8
  • Coreia do Sul8
  • Reino Unido5
  • Singapura4
  • Índia4
  • Espanha3
  • Alemanha3
  • Japão3

Setores mais afetados (30 dias)

  • Transportation28
  • Professional Services19
  • Healthcare13
  • Manufacturing11
  • Other10
  • Retail & E-Commerce8
  • Technology7
  • Financial Services3
  • Energy & Utilities3
  • Hospitality2

Grupos e as CVEs que exploram

clop 5akira 3alphv 3conti 3hive 3play 3medusa 2vicesociety 2atomsilo 1blackbyte 1blackshadow 1BrainCipher 1esxiargs 1frag 1handala 1icefire 1incransom 1karma 1lockbit 1maze 1nightsky 1nightspire 1nokoyawa 1revil 1reynolds 1underground 1

CVEs usadas em campanhas de ransomware

Severidade
Limpar

15 resultado(s)

CVE-2026-15410 Alta · 7.2 KEV Urgente · 71 Exploit público Ransomware CWE-94 14/07/2026
SonicWall SMA1000 Appliances Code Injection Vulnerability
Post-authentication improper control of generation of code ('Code Injection') vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) which in specific conditions could potentially enable a remote authenticated attacker as administrator to execute arbitrary OS commands.
CVE-2025-49704 Alta · 8.8 KEV Urgente · 78 Exploit público Ransomware CWE-94 08/07/2025
Microsoft SharePoint Code Injection Vulnerability
Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
CVE-2025-3248 Crítica · 9.8 KEV Urgente · 93 Exploit público Ransomware CWE-94 07/04/2025
Langflow Missing Authentication Vulnerability
Langflow versions prior to 1.3.0 are susceptible to code injection in the /api/v1/validate/code endpoint. A remote and unauthenticated attacker can send crafted HTTP requests to execute arbitrary code.
CVE-2024-23692 Crítica · 9.8 KEV Urgente · 93 Exploit público Ransomware CWE-94 31/05/2024
Rejetto HTTP File Server Improper Neutralization of Special Elements Used in a Template Engine Vulnerability
Rejetto HTTP File Server, up to and including version 2.3m, is vulnerable to a template injection vulnerability. This vulnerability allows a remote, unauthenticated attacker to execute arbitrary commands on the affected system by sending a specially crafted HTTP request. As of the CVE assignment date, Rejetto HFS 2.3m is no longer supported.
CVE-2023-24955 Alta · 7.2 KEV Urgente · 84 Exploit público Ransomware CWE-94 09/05/2023
Microsoft SharePoint Server Code Injection Vulnerability
Microsoft SharePoint Server Remote Code Execution Vulnerability
CVE-2021-44529 Crítica · 9.8 KEV Urgente · 93 Exploit público Ransomware CWE-94 08/12/2021
Ivanti Endpoint Manager Cloud Service Appliance (EPM CSA) Code Injection Vulnerability
A code injection vulnerability in the Ivanti EPM Cloud Services Appliance (CSA) allows an unauthenticated user to execute arbitrary code with limited permissions (nobody).
CVE-2023-3519 Crítica · 9.8 KEV Urgente · 100 Exploit público Ransomware CWE-94 19/07/2023
Citrix NetScaler ADC and NetScaler Gateway Code Injection Vulnerability
Unauthenticated remote code execution
CVE-2017-7494 Crítica · 9.8 KEV Urgente · 93 Exploit público Ransomware CWE-94 30/05/2017
Samba Remote Code Execution Vulnerability
Samba since version 3.5.0 and before 4.6.4, 4.5.10 and 4.4.14 is vulnerable to remote code execution vulnerability, allowing a malicious client to upload a shared library to a writable share, and then cause the server to load and execute it.
CVE-2022-41223 Média · 6.8 KEV Alta · 62 Ransomware CWE-94 21/11/2022
Mitel MiVoice Connect Code Injection Vulnerability
The Director database component of MiVoice Connect through 19.3 (22.22.6100.0) could allow an authenticated attacker to conduct a code-injection attack via crafted data due to insufficient restrictions on the database data type.
CVE-2022-22954 Crítica · 9.8 KEV Urgente · 93 Exploit público Ransomware CWE-94 11/04/2022
VMware Workspace ONE Access and Identity Manager Server-Side Template Injection Vulnerability
VMware Workspace ONE Access and Identity Manager contain a remote code execution vulnerability due to server-side template injection. A malicious actor with network access can trigger a server-side template injection that may result in remote code execution.
CVE-2018-7602 Crítica · 9.8 KEV Urgente · 82 Exploit público Ransomware CWE-94 19/07/2018
Execução remota de código no Drupal Core (CVE-2018-7602)
Existe uma vulnerabilidade de execução remota de código em múltiplos subsistemas do Drupal 7.x e 8.x. Isso potencialmente permite que atacantes explorem múltiplos vetores de ataque em um site Drupal, o que pode resultar no comprometimento do site. Esta vulnerabilidade está relacionada ao núcleo do Drupal - Altamente crítica - Execução remota de código - SA-CORE-2018-002. Tanto a SA-CORE-2018-002 quanto esta vulnerabilidade estão sendo exploradas na natureza.
CVE-2018-1273 Crítica · 9.8 KEV Urgente · 77 Exploit público Ransomware CWE-94 11/04/2018
VMware Tanzu Spring Data Commons Property Binder Vulnerability
Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property binder vulnerability caused by improper neutralization of special elements. An unauthenticated remote malicious user (or attacker) can supply specially crafted request parameters against Spring Data REST backed HTTP resources or using Spring Data's projection-based request payload binding hat can lead to a remote code execution attack.
CVE-2012-0158 Alta · 8.8 KEV Urgente · 96 Exploit público Ransomware CWE-94 10/04/2012
Microsoft MSCOMCTL.OCX Remote Code Execution Vulnerability
The (1) ListView, (2) ListView2, (3) TreeView, and (4) TreeView2 ActiveX controls in MSCOMCTL.OCX in the Common Controls in Microsoft Office 2003 SP3, 2007 SP2 and SP3, and 2010 Gold and SP1; Office 2003 Web Components SP3; SQL Server 2000 SP4, 2005 SP4, and 2008 SP2, SP3, and R2; BizTalk Server 2002 SP1; Commerce Server 2002 SP4, 2007 SP2, and 2009 Gold and R2; Visual FoxPro 8.0 SP1 and 9.0 SP2; and Visual Basic 6.0 Runtime allow remote attackers to execute arbitrary code via a crafted (a) web site, (b) Office document, or (c) .rtf file that triggers "system state" corruption, as exploited in the wild in April 2012, aka "MSCOMCTL.OCX RCE Vulnerability."
CVE-2021-22205 Crítica · 10.0 KEV Urgente · 93 Exploit público Ransomware CWE-94 23/04/2021
GitLab Community and Enterprise Editions Remote Code Execution Vulnerability
An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. GitLab was not properly validating image files that were passed to a file parser which resulted in a remote command execution.
CVE-2017-9822 Alta · 8.8 KEV Urgente · 86 Exploit público Ransomware CWE-94 20/07/2017
DotNetNuke (DNN) Remote Code Execution Vulnerability
DNN (aka DotNetNuke) before 9.1.1 has Remote Code Execution via a cookie, aka "2017-08 (Critical) Possible remote code execution on DNN sites."

Fontes: CISA KEV (campo knownRansomwareCampaignUse) e ransomware.live (grupos, TTPs e contagem de vítimas). A ausência de marcação na KEV não significa que a falha não seja usada por ransomware.