Início / Inteligência de ameaças
Ransomware Intelligence
A CISA marca uma vulnerabilidade como "usada por ransomware" apenas quando há campanha confirmada. Estas são as falhas que grupos de extorsão já exploraram: corrigi-las primeiro reduz o risco mais concreto.
361
CVEs usadas por ransomware · 21% do catálogo KEV
3
incluídas nos últimos 90 dias
173
críticas
121
vítimas divulgadas (30 dias)
408
grupos monitorados
Fabricantes mais explorados por ransomware
Fraquezas (CWE) mais comuns
- CWE-22 · Path Traversal36
- CWE-787 · Out-of-bounds Write27
- CWE-502 · Deserialization of Untrusted Data25
- CWE-94 · Code Injection15
- CWE-287 · Improper Authentication14
- CWE-306 · Missing Authentication for Critical Function14
- CWE-78 · OS Command Injection14
- CWE-59 · Link Following13
- CWE-416 · Use After Free11
- CWE-918 · Server-Side Request Forgery (SSRF)10
Grupos mais ativos (30 dias)
Vítimas divulgadas em sites de vazamento, segundo o ransomware.live. Não exibimos nomes de vítimas.
Países mais afetados (30 dias)
- Estados Unidos25
- Suécia10
- Brasil8
- Coreia do Sul8
- Reino Unido5
- Singapura4
- Índia4
- Espanha3
- Alemanha3
- Japão3
Setores mais afetados (30 dias)
- Transportation28
- Professional Services19
- Healthcare13
- Manufacturing11
- Other10
- Retail & E-Commerce8
- Technology7
- Financial Services3
- Energy & Utilities3
- Hospitality2
Grupos e as CVEs que exploram
clop 5akira 3alphv 3conti 3hive 3play 3medusa 2vicesociety 2atomsilo 1blackbyte 1blackshadow 1BrainCipher 1esxiargs 1frag 1handala 1icefire 1incransom 1karma 1lockbit 1maze 1nightsky 1nightspire 1nokoyawa 1revil 1reynolds 1underground 1CVEs usadas em campanhas de ransomware
27 resultado(s)
CVE-2026-59310
Crítica · 9.8
KEV Urgente · 77 Exploit público Ransomware CWE-22 30/07/2026
Broadcom VMware vCenter Path Traversal Vulnerability
VMware vCenter contains a directory traversal vulnerability in the Syslog server. A malicious actor with network access to vCenter may exploit this issue to execute arbitrary code.
CVE-2026-63077
Crítica · 9.8
KEV Urgente · 93 Exploit público Ransomware CWE-502 27/07/2026
JetBrains TeamCity Deserialization of Untrusted Data Vulnerability
In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent polling protocol
CVE-2026-20316
Média · 5.3
KEV Alta · 66 Ransomware CWE-259 29/07/2026
Cisco Secure Firewall Management Center Use of Hard-coded Password Vulnerability
A vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to log in to an affected device using a low-privileged account to access sensitive data within the impacted systems.
This vulnerability is due to the presence of static user credentials for a low-privileged account. An attacker could exploit this vulnerability by using the account to log in to an affected system. A successful exploit could allow the attacker to log in to the affected system and access sensitive data as the low-privileged user.
Note: If the FMC management interface does not have public internet access, the attack surface that is associated with this vulnerability is reduced.
Cisco has assigned this security advisory a Security Impact Rating (SIR) of High rather than Medium as the score indicates. The reason is that this vulnerability can be used with other Cisco Secure FMC Software vulnerabilities to elevate privileges.
CVE-2026-15410
Alta · 7.2
KEV Urgente · 71 Exploit público Ransomware CWE-94 14/07/2026
SonicWall SMA1000 Appliances Code Injection Vulnerability
Post-authentication improper control of generation of code ('Code Injection') vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) which in specific conditions could potentially enable a remote authenticated attacker as administrator to execute arbitrary OS commands.
CVE-2026-15409
Crítica · 10.0
KEV Urgente · 92 Exploit público Ransomware CWE-918 14/07/2026
SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability
A Server-side request forgery (SSRF) vulnerability has been identified in the SMA1000 Appliance Work Place interface. A remote unauthenticated attacker could potentially cause the appliance to make requests to unintended location.
CVE-2026-45659
Alta · 8.8
KEV Urgente · 70 Exploit público Ransomware CWE-502 22/05/2026
Microsoft SharePoint Server Deserialization of Untrusted Data Vulnerability
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
CVE-2026-12569
Crítica · 9.8
KEV Urgente · 73 Ransomware CWE-20 17/06/2026
PTC Windchill and FlexPLM Improper Input Validation Vulnerability
A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill PDMlink and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data. * This advisory also applies to all CPS versions
* The identified vulnerability also impacts Windchill and FlexPLM releases prior to 11.0 M030
CVE-2026-35273
Crítica · 9.8
KEV Urgente · 93 Exploit público Ransomware CWE-306 11/06/2026
Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Updates Environment Management). Supported versions that are affected are 8.61 and 8.62. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise PeopleTools. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
CVE-2026-50751
Crítica · 9.3
KEV Urgente · 83 Exploit público Ransomware CWE-287 08/06/2026
Check Point Security Gateway Improper Authentication Vulnerability
A logic flow weakness in Remote Access and Mobile Access certificate validation in deprecated IKEv1 key exchange allows an unauthenticated remote attacker to bypass user authentication and establish a remote access VPN connection without a valid user password.
CVE-2026-0257
Crítica · 9.1
KEV Urgente · 80 Exploit público Ransomware CWE-565 13/05/2026
Palo Alto Networks PAN-OS Authentication Bypass Vulnerability
Authentication bypass vulnerabilities in the GlobalProtect portal and gateway of Palo Alto Networks PAN-OS® software allows the attacker to bypass security restrictions and establish an unauthorized VPN connection.
Panorama and Cloud NGFW are not impacted by these issues.
CVE-2026-45321
Crítica · 9.6
KEV Urgente · 71 Exploit público Ransomware CWE-506 11/05/2026
TanStack Unspecified Vulnerability
On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were published to the npm registry. The publishes were authenticated via the legitimate GitHub Actions OIDC trusted-publisher binding for TanStack/router, but the publish workflow itself was not modified. The attacker chained three known vulnerability classes — a pull_request_target "Pwn Request" misconfiguration, GitHub Actions cache poisoning across the fork↔base trust boundary, and runtime memory extraction of the OIDC token from the Actions runner process — to publish credential-stealing malware under a trusted identity. Each affected package received exactly two malicious versions, published a few minutes apart.
CVE-2026-48027
Crítica · 9.8
KEV Alta · 69 Ransomware CWE-506 27/05/2026
Nx Console Embedded Malicious Code Vulnerability
Nx Console is the user interface for Nx & Lerna. On 19 May 2026, a malicious version of Nx Console, 18.95.0, was published at 12:30 PM UTC and removed soon after at 12:48 PM UTC, leaving it available for ~18 minutes in Visual Studio Marketplace. For OpenVSX, the problem was detected later, and the compromised version was available from 12:33 UTC to 13:09 UTC (~36 minutes). Version 18.100.0 of Nx Console is not compromised and users may remediate by upgrading to that version.
CVE-2026-41940
Crítica · 9.8
KEV Urgente · 93 Exploit público Ransomware CWE-306 29/04/2026
WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function Vulnerability
cPanel and WHM versions after 11.40 contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel.
CVE-2024-1708
Alta · 8.4
KEV Urgente · 86 Exploit público Ransomware CWE-22 21/02/2024
ConnectWise ScreenConnect Path Traversal Vulnerability
ConnectWise ScreenConnect 23.9.7 and prior are affected by path-traversal vulnerability, which may allow an attacker
the ability to execute remote code or directly impact confidential data or critical systems.
CVE-2024-57726
Crítica · 9.9
KEV Urgente · 74 Exploit público Ransomware CWE-862 15/01/2025
SimpleHelp Missing Authorization Vulnerability
SimpleHelp remote support software v5.5.7 and before has a vulnerability that allows low-privileges technicians to create API keys with excessive permissions. These API keys can be used to escalate privileges to the server admin role.
CVE-2024-57728
Alta · 7.2
KEV Urgente · 70 Exploit público Ransomware CWE-59 15/01/2025
SimpleHelp Path Traversal Vulnerability
SimpleHelp remote support software v5.5.7 and before allows admin users to upload arbitrary files anywhere on the file system by uploading a crafted zip file (i.e. zip slip). This can be exploited to execute arbitrary code on the host in the context of the SimpleHelp server user.
CVE-2026-33825
Alta · 7.8
KEV Alta · 62 Exploit público Ransomware CWE-1220 14/04/2026
Microsoft Defender Insufficient Granularity of Access Control Vulnerability
Insufficient granularity of access control in Microsoft Defender allows an authorized attacker to elevate privileges locally.
CVE-2024-27199
Alta · 7.3
KEV Urgente · 73 Exploit público Ransomware CWE-22 04/03/2024
JetBrains TeamCity Relative Path Traversal Vulnerability
In JetBrains TeamCity before 2023.11.4 path traversal allowing to perform limited admin actions was possible
CVE-2023-27351
Alta · 7.5
KEV Urgente · 73 Exploit público Ransomware CWE-287 20/04/2023
PaperCut NG/MF Improper Authentication Vulnerability
This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 (Build 63914). Authentication is not required to exploit this vulnerability. The specific flaw exists within the SecurityRequestFilter class. The issue results from improper implementation of the authentication algorithm. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-19226.
CVE-2023-21529
Alta · 8.8
KEV Alta · 66 Ransomware CWE-502 14/02/2023
Microsoft Exchange Server Deserialization of Untrusted Data Vulnerability
Microsoft Exchange Server Remote Code Execution Vulnerability
CVE-2025-60710
Alta · 7.8
KEV Urgente · 71 Exploit público Ransomware CWE-59 11/11/2025
Microsoft Windows Link Following Vulnerability
Improper link resolution before file access ('link following') in Host Process for Windows Tasks allows an authorized attacker to elevate privileges locally.
CVE-2026-20131
Crítica · 10.0
KEV Urgente · 79 Exploit público Ransomware CWE-502 04/03/2026
Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management Deserialization of Untrusted Data Vulnerability
A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to execute arbitrary Java code as root on an affected device.
This vulnerability is due to insecure deserialization of a user-supplied Java byte stream. An attacker could exploit this vulnerability by sending a crafted serialized Java object to the web-based management interface of an affected device. A successful exploit could allow the attacker to execute arbitrary code on the device and elevate privileges to root.
Note: If the FMC management interface does not have public internet access, the attack surface that is associated with this vulnerability is reduced.
CVE-2025-26399
Crítica · 9.8
KEV Urgente · 83 Exploit público Ransomware CWE-502 23/09/2025
SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability
SolarWinds Web Help Desk was found to be susceptible to an unauthenticated AjaxProxy deserialization remote code execution vulnerability that, if exploited, would allow an attacker to run commands on the host machine. This vulnerability is a patch bypass of CVE-2024-28988, which in turn is a patch bypass of CVE-2024-28986.
CVE-2026-1731
Crítica · 9.8
KEV Urgente · 93 Exploit público Ransomware CWE-78 06/02/2026
BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) OS Command Injection Vulnerability
BeyondTrust Remote Support (RS) and certain older versions of Privileged Remote Access (PRA) contain a critical pre-authentication remote code execution vulnerability. By sending specially crafted requests, an unauthenticated remote attacker may be able to execute operating system commands in the context of the site user.
CVE-2026-24423
Crítica · 9.8
KEV Urgente · 83 Exploit público Ransomware CWE-306 23/01/2026
SmarterTools SmarterMail Missing Authentication for Critical Function Vulnerability
SmarterTools SmarterMail versions prior to build 9511 contain an unauthenticated remote code execution vulnerability in the ConnectToHub API method. The attacker could point the SmarterMail to the malicious HTTP server, which serves the malicious OS command. This command will be executed by the vulnerable application.
Fontes: CISA KEV (campo knownRansomwareCampaignUse) e ransomware.live (grupos, TTPs e contagem de vítimas). A ausência de marcação na KEV não significa que a falha não seja usada por ransomware.