CVE Intelligence
Início / Inteligência de ameaças

Ransomware Intelligence

A CISA marca uma vulnerabilidade como "usada por ransomware" apenas quando há campanha confirmada. Estas são as falhas que grupos de extorsão já exploraram: corrigi-las primeiro reduz o risco mais concreto.

361
CVEs usadas por ransomware · 21% do catálogo KEV
3
incluídas nos últimos 90 dias
173
críticas
121
vítimas divulgadas (30 dias)
408
grupos monitorados

Fabricantes mais explorados por ransomware

Fraquezas (CWE) mais comuns

Por ano de inclusão na KEV

Grupos mais ativos (30 dias)

Vítimas divulgadas em sites de vazamento, segundo o ransomware.live. Não exibimos nomes de vítimas.

GrupoVítimasÚltima atividade
N0n 41 12 h
Wallstreet 13 1 d
qilin 9 1 d
interlock 6 3 d
play 5 2 d
akira 3 23 h
AuditTeam 3 2 d
Dark Project 3 2 d
lockbit5 3 1 d
Emperador 3 7 h
everest 3 2 d
iah6477 3 5 h
Todos os grupos →

Países mais afetados (30 dias)

  • Estados Unidos25
  • Suécia10
  • Brasil8
  • Coreia do Sul8
  • Reino Unido5
  • Singapura4
  • Índia4
  • Espanha3
  • Alemanha3
  • Japão3

Setores mais afetados (30 dias)

  • Transportation28
  • Professional Services19
  • Healthcare13
  • Manufacturing11
  • Other10
  • Retail & E-Commerce8
  • Technology7
  • Financial Services3
  • Energy & Utilities3
  • Hospitality2

Grupos e as CVEs que exploram

clop 5akira 3alphv 3conti 3hive 3play 3medusa 2vicesociety 2atomsilo 1blackbyte 1blackshadow 1BrainCipher 1esxiargs 1frag 1handala 1icefire 1incransom 1karma 1lockbit 1maze 1nightsky 1nightspire 1nokoyawa 1revil 1reynolds 1underground 1

CVEs usadas em campanhas de ransomware

Severidade
Limpar

117 resultado(s)

CVE-2026-45659 Alta · 8.8 KEV Urgente · 70 Exploit público Ransomware CWE-502 22/05/2026
Microsoft SharePoint Server Deserialization of Untrusted Data Vulnerability
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
CVE-2026-33825 Alta · 7.8 KEV Alta · 62 Exploit público Ransomware CWE-1220 14/04/2026
Microsoft Defender Insufficient Granularity of Access Control Vulnerability
Insufficient granularity of access control in Microsoft Defender allows an authorized attacker to elevate privileges locally.
CVE-2023-21529 Alta · 8.8 KEV Alta · 66 Ransomware CWE-502 14/02/2023
Microsoft Exchange Server Deserialization of Untrusted Data Vulnerability
Microsoft Exchange Server Remote Code Execution Vulnerability
CVE-2025-60710 Alta · 7.8 KEV Urgente · 71 Exploit público Ransomware CWE-59 11/11/2025
Microsoft Windows Link Following Vulnerability
Improper link resolution before file access ('link following') in Host Process for Windows Tasks allows an authorized attacker to elevate privileges locally.
CVE-2021-43226 Alta · 7.8 KEV Urgente · 70 Exploit público Ransomware 15/12/2021
Microsoft Windows Privilege Escalation Vulnerability
Windows Common Log File System Driver Elevation of Privilege Vulnerability
CVE-2025-49706 Média · 6.5 KEV Urgente · 83 Exploit público Ransomware CWE-287 08/07/2025
Microsoft SharePoint Improper Authentication Vulnerability
Improper authentication in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.
CVE-2025-49704 Alta · 8.8 KEV Urgente · 78 Exploit público Ransomware CWE-94 08/07/2025
Microsoft SharePoint Code Injection Vulnerability
Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
CVE-2025-53770 Crítica · 9.8 KEV Urgente · 93 Exploit público Ransomware CWE-502 19/07/2025
Microsoft SharePoint Deserialization of Untrusted Data Vulnerability
Deserialization of untrusted data in on-premises Microsoft SharePoint Server allows an unauthorized attacker to execute code over a network. Microsoft is aware that an exploit for CVE-2025-53770 exists in the wild. Microsoft is preparing and fully testing a comprehensive update to address this vulnerability. In the meantime, please make sure that the mitigation provided in this CVE documentation is in place so that you are protected from exploitation.
CVE-2025-29824 Alta · 7.8 KEV Urgente · 71 Exploit público Ransomware CWE-416 08/04/2025
Microsoft Windows Common Log File System (CLFS) Driver Use-After-Free Vulnerability
Use after free in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.
CVE-2025-26633 Alta · 7.0 KEV Urgente · 80 Exploit público Ransomware CWE-707 11/03/2025
Microsoft Windows Management Console (MMC) Improper Neutralization Vulnerability
Improper neutralization in Microsoft Management Console allows an unauthorized attacker to bypass a security feature locally.
CVE-2018-8639 Alta · 7.8 KEV Alta · 66 Ransomware CWE-404 11/12/2018
Microsoft Windows Win32k Improper Resource Shutdown or Release Vulnerability
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka "Win32k Elevation of Privilege Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2019, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers. This CVE ID is unique from CVE-2018-8641.
CVE-2024-49039 Alta · 8.8 KEV Urgente · 71 Exploit público Ransomware CWE-287 12/11/2024
Microsoft Windows Task Scheduler Privilege Escalation Vulnerability
Windows Task Scheduler Elevation of Privilege Vulnerability
CVE-2024-38094 Alta · 7.2 KEV Alta · 66 Ransomware CWE-502 09/07/2024
Microsoft SharePoint Deserialization Vulnerability
Microsoft SharePoint Remote Code Execution Vulnerability
CVE-2024-30088 Alta · 7.0 KEV Urgente · 82 Exploit público Ransomware CWE-367 11/06/2024
Microsoft Windows Kernel TOCTOU Race Condition Vulnerability
Windows Kernel Elevation of Privilege Vulnerability
CVE-2020-0618 Alta · 8.8 KEV Urgente · 86 Exploit público Ransomware CWE-502 11/02/2020
Microsoft SQL Server Reporting Services Remote Code Execution Vulnerability
A remote code execution vulnerability exists in Microsoft SQL Server Reporting Services when it incorrectly handles page requests, aka 'Microsoft SQL Server Reporting Services Remote Code Execution Vulnerability'.
CVE-2024-26169 Alta · 7.8 KEV Urgente · 71 Exploit público Ransomware CWE-269 12/03/2024
Microsoft Windows Error Reporting Service Improper Privilege Management Vulnerability
Windows Error Reporting Service Elevation of Privilege Vulnerability
CVE-2024-30051 Alta · 7.8 KEV Urgente · 71 Exploit público Ransomware CWE-787 14/05/2024
Microsoft DWM Core Library Privilege Escalation Vulnerability
Windows DWM Core Library Elevation of Privilege Vulnerability
CVE-2023-24955 Alta · 7.2 KEV Urgente · 84 Exploit público Ransomware CWE-94 09/05/2023
Microsoft SharePoint Server Code Injection Vulnerability
Microsoft SharePoint Server Remote Code Execution Vulnerability
CVE-2024-21338 Alta · 7.8 KEV Urgente · 80 Exploit público Ransomware CWE-822 13/02/2024
Microsoft Windows Kernel Exposed IOCTL with Insufficient Access Control Vulnerability
Windows Kernel Elevation of Privilege Vulnerability
CVE-2024-21412 Alta · 8.1 KEV Urgente · 72 Exploit público Ransomware CWE-693 13/02/2024
Microsoft Windows Internet Shortcut Files Security Feature Bypass Vulnerability
Internet Shortcut Files Security Feature Bypass Vulnerability
CVE-2023-29357 Crítica · 9.8 KEV Urgente · 93 Exploit público Ransomware CWE-303 13/06/2023
Microsoft SharePoint Server Privilege Escalation Vulnerability
Microsoft SharePoint Server Elevation of Privilege Vulnerability
CVE-2023-36884 Alta · 7.5 KEV Urgente · 72 Exploit público Ransomware CWE-362 11/07/2023
Microsoft Windows Search Remote Code Execution Vulnerability
Windows Search Remote Code Execution Vulnerability
CVE-2023-28252 Alta · 7.8 KEV Urgente · 84 Exploit público Ransomware CWE-787 11/04/2023
Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation Vulnerability
Windows Common Log File System Driver Elevation of Privilege Vulnerability
CVE-2019-1388 Alta · 7.8 KEV Alta · 65 Ransomware CWE-269 12/11/2019
Microsoft Windows Certificate Dialog Privilege Escalation Vulnerability
An elevation of privilege vulnerability exists in the Windows Certificate Dialog when it does not properly enforce user privileges, aka 'Windows Certificate Dialog Elevation of Privilege Vulnerability'.
CVE-2023-24880 Média · 4.4 KEV Alta · 63 Ransomware CWE-863 14/03/2023
Microsoft Windows SmartScreen Security Feature Bypass Vulnerability
Windows SmartScreen Security Feature Bypass Vulnerability

Fontes: CISA KEV (campo knownRansomwareCampaignUse) e ransomware.live (grupos, TTPs e contagem de vítimas). A ausência de marcação na KEV não significa que a falha não seja usada por ransomware.