Used in ransomware

As of , 361 vulnerabilities on CISA's list are known to be used in ransomware campaigns.

#VulnerabilityProductOur groupListedDeadlineEPSS
1CVE-2026-63077Deserialization of Untrusted DataJetBrains TeamCityPatch nowForensic triage required by CISA; ransomware use, listed within a year; Metasploit module0.90
2CVE-2026-41940Missing Authentication for Critical FunctionWebPros cPanel & WHM and WP2 (WordPress Squared)Patch nowRansomware use, listed within a year; Metasploit module0.99
3CVE-2024-1708Path TraversalConnectWise ScreenConnectPatch nowRansomware use, listed within a year; Metasploit module0.95
4CVE-2026-1731OS Command InjectionBeyondTrust Remote Support (RS) and Privileged Remote Access (PRA)Patch nowRansomware use, listed within a year; Metasploit module0.91
5CVE-2025-52691Unrestricted Upload of File with Dangerous TypeSmarterTools SmarterMailPatch nowRansomware use, listed within a year; Metasploit module0.86
6CVE-2025-55182Remote Code ExecutionMeta React Server ComponentsPatch nowRansomware use, listed within a year; Metasploit module0.99
7CVE-2026-15409Server-Side Request ForgerySonicWall SMA1000 AppliancesPatch nowForensic triage required by CISA; ransomware use, listed within a year; Metasploit module0.07
8CVE-2026-0257Authentication BypassPalo Alto Networks PAN-OSPatch nowRansomware use, listed within a year0.97
9CVE-2024-57726Missing AuthorizationSimpleHelp SimpleHelpPatch nowRansomware use, listed within a year0.67
10CVE-2024-57728Path TraversalSimpleHelp SimpleHelpPatch nowRansomware use, listed within a year0.65
11CVE-2023-27351Improper AuthenticationPaperCut NG/MFPatch nowRansomware use, listed within a year0.78
12CVE-2024-27199Relative Path TraversalJetBrains TeamCityPatch nowRansomware use, listed within a year0.99
13CVE-2023-21529Deserialization of Untrusted DataMicrosoft Exchange ServerPatch nowRansomware use, listed within a year0.59
14CVE-2025-26399Deserialization of Untrusted DataSolarWinds Web Help DeskPatch nowRansomware use, listed within a year0.90
15CVE-2026-24423Missing Authentication for Critical FunctionSmarterTools SmarterMailPatch nowRansomware use, listed within a year0.88
16CVE-2026-23760Authentication Bypass Using an Alternate Path or ChannelSmarterTools SmarterMailPatch nowRansomware use, listed within a year0.97
17CVE-2025-61884Server-Side Request Forgery (SSRF)Oracle E-Business SuitePatch nowRansomware use, listed within a year0.96
18CVE-2026-20316Secure Firewall Management Center Use of Hard-coded PasswordCisco Secure Firewall Management Center (FMC)Patch nowRansomware use, listed within a year0.35
19CVE-2026-12569Improper Input ValidationPTC Windchill and FlexPLMPatch nowRansomware use, listed within a year0.46
20CVE-2026-20131Software and Cisco Security Cloud Control (SCC) Firewall Management Deserialization of Untrusted DataCisco Secure Firewall Management Center (FMC)Patch nowRansomware use, listed within a year0.43
21CVE-2025-14733Out of Bounds WriteWatchGuard FireboxPatch nowRansomware use, listed within a year0.27
22CVE-2026-15410Code InjectionSonicWall SMA1000 AppliancesPatch nowForensic triage required by CISA; ransomware use, listed within a year0.12
23CVE-2026-35273Missing Authentication for Critical FunctionOracle PeopleSoft Enterprise PeopleToolsPatch nowRansomware use, listed within a year0.09
24CVE-2026-50751Improper AuthenticationCheck Point Security GatewayPatch nowRansomware use, listed within a year0.06
25CVE-2025-60710Link FollowingMicrosoft WindowsPatch nowRansomware use, listed within a year0.05
26CVE-2026-45659Deserialization of Untrusted DataMicrosoft SharePoint ServerPatch nowForensic triage required by CISA; ransomware use, listed within a year0.03
27CVE-2026-59310Path TraversalBroadcom VMware vCenterPatch nowForensic triage required by CISA; ransomware use, listed within a year0.03
28CVE-2026-48027Embedded Malicious CodeNx Nx ConsolePatch nowRansomware use, listed within a year0.01
29CVE-2026-45321UnspecifiedTanStack TanStackPatch nowRansomware use, listed within a year0.01
30CVE-2026-33825Insufficient Granularity of Access ControlMicrosoft DefenderPatch nowRansomware use, listed within a year0.00
31CVE-2017-7494Remote Code ExecutionSamba SambaPatch this weekRansomware use; Metasploit module; EPSS 0.99; verified Exploit-DB entry0.99
32CVE-2010-0738Authentication BypassRed Hat JBossPatch this weekRansomware use; Metasploit module; EPSS 0.80; verified Exploit-DB entry0.80
33CVE-2013-0074Double DereferenceMicrosoft SilverlightPatch this weekRansomware use; Metasploit module; EPSS 0.79; verified Exploit-DB entry0.79
34CVE-2013-0422JRE Remote Code ExecutionOracle Java Runtime Environment (JRE)Patch this weekRansomware use; Metasploit module; EPSS 0.97; verified Exploit-DB entry0.97
35CVE-2013-0431JRE Sandbox BypassOracle Java Runtime Environment (JRE)Patch this weekRansomware use; Metasploit module; EPSS 0.90; verified Exploit-DB entry0.90
36CVE-2017-0147Windows SMBv1 Information DisclosureMicrosoft SMBv1 serverPatch this weekRansomware use; Metasploit module; EPSS 0.99; verified Exploit-DB entry0.99
37CVE-2017-0148Remote Code ExecutionMicrosoft SMBv1 serverPatch this weekRansomware use; Metasploit module; EPSS 0.99; verified Exploit-DB entry0.99
38CVE-2013-2465UnspecifiedOracle Java SEPatch this weekRansomware use; Metasploit module; EPSS 0.99; verified Exploit-DB entry0.99
39CVE-2013-2551Use-After-FreeMicrosoft Internet ExplorerPatch this weekRansomware use; Metasploit module; EPSS 0.74; verified Exploit-DB entry0.74
40CVE-2010-2861Directory TraversalAdobe ColdFusionPatch this weekRansomware use; Metasploit module; EPSS 0.99; verified Exploit-DB entry0.99
41CVE-2017-0146SMB Remote Code ExecutionMicrosoft WindowsPatch this weekRansomware use; Metasploit module; EPSS 0.90; verified Exploit-DB entry0.90
42CVE-2018-11138Remote Command ExecutionQuest KACE System Management AppliancePatch this weekRansomware use; Metasploit module; EPSS 0.92; verified Exploit-DB entry0.92
43CVE-2019-11043Buffer OverflowPHP FastCGI Process Manager (FPM)Patch this weekRansomware use; Metasploit module; EPSS 0.99; verified Exploit-DB entry0.99
44CVE-2019-15107Command InjectionWebmin WebminPatch this weekRansomware use; Metasploit module; EPSS 0.99; verified Exploit-DB entry0.99
45CVE-2018-8120Privilege EscalationMicrosoft Win32kPatch this weekRansomware use; Metasploit module; EPSS 0.73; verified Exploit-DB entry0.73
46CVE-2009-3960Information DisclosureAdobe BlazeDSPatch this weekRansomware use; Metasploit module; EPSS 0.90; verified Exploit-DB entry0.90
47CVE-2008-2992Reader and Acrobat Input ValidationAdobe Acrobat and ReaderPatch this weekRansomware use; Metasploit module; EPSS 0.98; verified Exploit-DB entry0.98
48CVE-2010-0188Arbitrary Code ExecutionAdobe Reader and AcrobatPatch this weekRansomware use; Metasploit module; EPSS 0.88; verified Exploit-DB entry0.88
49CVE-2012-0507Runtime Environment (JRE) Arbitrary Code ExecutionOracle Java SEPatch this weekRansomware use; Metasploit module; EPSS 0.98; verified Exploit-DB entry0.98
50CVE-2012-1723Runtime Environment (JRE) Arbitrary Code ExecutionOracle Java SEPatch this weekRansomware use; Metasploit module; EPSS 0.94; verified Exploit-DB entry0.94
51CVE-2012-4681Runtime Environment (JRE) Arbitrary Code ExecutionOracle Java SEPatch this weekRansomware use; Metasploit module; EPSS 0.99; verified Exploit-DB entry0.99
52CVE-2015-1701Privilege EscalationMicrosoft Win32kPatch this weekRansomware use; Metasploit module; EPSS 0.56; verified Exploit-DB entry0.56
53CVE-2016-4117Arbitrary Code ExecutionAdobe Flash PlayerPatch this weekRansomware use; Metasploit module; EPSS 0.94; verified Exploit-DB entry0.94
54CVE-2018-20250Absolute Path TraversalRARLAB WinRARPatch this weekRansomware use; Metasploit module; EPSS 0.96; verified Exploit-DB entry0.96
55CVE-2017-0144Remote Code ExecutionMicrosoft SMBv1Patch this weekRansomware use; Metasploit module; EPSS 0.99; verified Exploit-DB entry0.99
56CVE-2017-0145Remote Code ExecutionMicrosoft SMBv1Patch this weekRansomware use; Metasploit module; EPSS 0.90; verified Exploit-DB entry0.90
57CVE-2017-10271Corporation WebLogic Server Remote Code ExecutionOracle WebLogic ServerPatch this weekRansomware use; Metasploit module; EPSS 0.99; verified Exploit-DB entry0.99
58CVE-2018-8453Privilege EscalationMicrosoft Win32kPatch this weekRansomware use; Metasploit module; EPSS 0.70; verified Exploit-DB entry0.70
59CVE-2019-2725WebLogic Server, InjectionOracle WebLogic ServerPatch this weekRansomware use; Metasploit module; EPSS 0.99; verified Exploit-DB entry0.99
60CVE-2012-0158Remote Code ExecutionMicrosoft MSCOMCTL.OCXPatch this weekRansomware use; Metasploit module; EPSS 0.99; verified Exploit-DB entry0.99
61CVE-2017-0143Server Message Block (SMBv1) Remote Code ExecutionMicrosoft WindowsPatch this weekRansomware use; Metasploit module; EPSS 0.93; verified Exploit-DB entry0.93
62CVE-2017-0199Remote Code ExecutionMicrosoft Office and WordPadPatch this weekRansomware use; Metasploit module; EPSS 0.99; verified Exploit-DB entry0.99
63CVE-2017-5638Remote Code ExecutionApache StrutsPatch this weekRansomware use; Metasploit module; EPSS 0.99; verified Exploit-DB entry0.99
64CVE-2017-9822Remote Code ExecutionDotNetNuke (DNN) DotNetNuke (DNN)Patch this weekRansomware use; Metasploit module; EPSS 0.95; verified Exploit-DB entry0.95
65CVE-2018-7600Remote Code ExecutionDrupal Drupal CorePatch this weekRansomware use; Metasploit module; EPSS 0.99; verified Exploit-DB entry0.99
66CVE-2019-0708Remote Code ExecutionMicrosoft Remote Desktop ServicesPatch this weekRansomware use; Metasploit module; EPSS 0.99; verified Exploit-DB entry0.99
67CVE-2019-3396Confluence Server and Data Center Server-Side Template InjectionAtlassian Confluence Server and Data ServerPatch this weekRansomware use; Metasploit module; EPSS 0.99; verified Exploit-DB entry0.99
68CVE-2019-11539Pulse Connect Secure and Policy Secure Command InjectionIvanti Pulse Connect Secure and Pulse Policy SecurePatch this weekRansomware use; Metasploit module; EPSS 0.99; verified Exploit-DB entry0.99
69CVE-2020-0688Validation Key Remote Code ExecutionMicrosoft Exchange ServerPatch this weekRansomware use; Metasploit module; EPSS 0.99; verified Exploit-DB entry0.99
70CVE-2021-41773Path TraversalApache HTTP ServerPatch this weekRansomware use; Metasploit module; EPSS 0.99; verified Exploit-DB entry0.99
71CVE-2021-42013Path TraversalApache HTTP ServerPatch this weekRansomware use; Metasploit module; EPSS 0.99; verified Exploit-DB entry0.99
72CVE-2019-0841AppX Deployment Service (AppXSVC) Privilege EscalationMicrosoft WindowsPatch this weekRansomware use; Metasploit module; verified Exploit-DB entry0.41
73CVE-2019-1405Universal Plug and Play (UPnP) Service Privilege EscalationMicrosoft WindowsPatch this weekRansomware use; Metasploit module; verified Exploit-DB entry0.30
74CVE-2016-0099Secondary Logon Service Privilege EscalationMicrosoft WindowsPatch this weekRansomware use; Metasploit module; verified Exploit-DB entry0.37
75CVE-2019-1322Privilege EscalationMicrosoft WindowsPatch this weekRansomware use; Metasploit module; verified Exploit-DB entry0.19
76CVE-2025-61882UnspecifiedOracle E-Business SuitePatch this weekRansomware use; Metasploit module; EPSS 0.990.99
77CVE-2025-49704Code InjectionMicrosoft SharePointPatch this weekRansomware use; Metasploit module; EPSS 0.990.99
78CVE-2025-49706Improper AuthenticationMicrosoft SharePointPatch this weekRansomware use; Metasploit module; EPSS 0.990.99
79CVE-2025-53770Deserialization of Untrusted DataMicrosoft SharePointPatch this weekRansomware use; Metasploit module; EPSS 0.990.99
80CVE-2025-3248Missing AuthenticationLangflow LangflowPatch this weekRansomware use; Metasploit module; EPSS 0.990.99
81CVE-2025-22457Stack-Based Buffer OverflowIvanti Connect Secure, Policy Secure, and ZTA GatewaysPatch this weekRansomware use; Metasploit module; EPSS 0.990.99
82CVE-2024-57727Path TraversalSimpleHelp SimpleHelpPatch this weekRansomware use; Metasploit module; EPSS 0.970.97
83CVE-2024-55956Unauthenticated File UploadCleo Multiple ProductsPatch this weekRansomware use; Metasploit module; EPSS 0.940.94
84CVE-2024-51378Incorrect Default PermissionsCyberPersons CyberPanelPatch this weekRansomware use; Metasploit module; EPSS 0.950.95
85CVE-2024-0012Management Interface Authentication BypassPalo Alto Networks PAN-OSPatch this weekRansomware use; Metasploit module; EPSS 0.990.99
86CVE-2024-9474Management Interface OS Command InjectionPalo Alto Networks PAN-OSPatch this weekRansomware use; Metasploit module; EPSS 0.950.95
87CVE-2024-51567Incorrect Default PermissionsCyberPersons CyberPanelPatch this weekRansomware use; Metasploit module; EPSS 0.870.87
88CVE-2020-0618Reporting Services Remote Code ExecutionMicrosoft SQL ServerPatch this weekRansomware use; Metasploit module; EPSS 0.990.99
89CVE-2024-6670SQL InjectionProgress WhatsUp GoldPatch this weekRansomware use; Metasploit module; EPSS 0.930.93
90CVE-2024-23897Path TraversalJenkins Jenkins Command Line Interface (CLI)Patch this weekRansomware use; Metasploit module; EPSS 0.990.99
91CVE-2024-23692Improper Neutralization of Special Elements Used in a Template EngineRejetto HTTP File ServerPatch this weekRansomware use; Metasploit module; EPSS 0.990.99
92CVE-2024-4577PHP-CGI OS Command InjectionPHP Group PHPPatch this weekRansomware use; Metasploit module; EPSS 0.990.99
93CVE-2024-24919Information DisclosureCheck Point Quantum Security GatewaysPatch this weekRansomware use; Metasploit module; EPSS 0.990.99
94CVE-2023-43208Deserialization of Untrusted DataNextGen Healthcare Mirth ConnectPatch this weekRansomware use; Metasploit module; EPSS 0.830.83
95CVE-2024-3400Command InjectionPalo Alto Networks PAN-OSPatch this weekRansomware use; Metasploit module; EPSS 0.990.99
96CVE-2023-24955Code InjectionMicrosoft SharePoint ServerPatch this weekRansomware use; Metasploit module; EPSS 0.850.85
97CVE-2021-44529Code InjectionIvanti Endpoint Manager Cloud Service Appliance (EPM CSA)Patch this weekRansomware use; Metasploit module; EPSS 0.990.99
98CVE-2023-48788SQL InjectionFortinet FortiClient EMSPatch this weekRansomware use; Metasploit module; EPSS 0.980.98
99CVE-2024-27198Authentication BypassJetBrains TeamCityPatch this weekRansomware use; Metasploit module; EPSS 0.990.99
100CVE-2024-1709Authentication BypassConnectWise ScreenConnectPatch this weekRansomware use; Metasploit module; EPSS 0.990.99

Ransomware use changed to Known

CISA changes this flag without saying so; these are the changes our record has seen, newest first.

  1. CVE-2026-63077 JetBrains TeamCityRansomware use: Unknown to Known.
  2. CVE-2026-59310 Broadcom VMware vCenterRansomware use: Unknown to Known.
  3. CVE-2026-20316 Cisco Secure Firewall Management Center (FMC)Ransomware use: Unknown to Known.
  4. CVE-2022-41352 Synacor Zimbra Collaboration Suite (ZCS)Ransomware use: Unknown to Known.
  5. CVE-2019-0859 Microsoft Win32kRansomware use: Unknown to Known.
  6. CVE-2016-7255 Microsoft Win32kRansomware use: Unknown to Known.
  7. CVE-2025-14733 WatchGuard FireboxRansomware use: Unknown to Known.
  8. CVE-2022-37969 Microsoft WindowsRansomware use: Unknown to Known.
  9. CVE-2016-4117 Adobe Flash PlayerRansomware use: Unknown to Known.
  10. CVE-2021-43226 Microsoft WindowsRansomware use: Unknown to Known.
  11. CVE-2020-5135 SonicWall SonicOSRansomware use: Unknown to Known.
  12. CVE-2012-0158 Microsoft MSCOMCTL.OCXRansomware use: Unknown to Known.
  13. CVE-2025-60710 Microsoft WindowsRansomware use: Unknown to Known.
  14. CVE-2022-21882 Microsoft Win32kRansomware use: Unknown to Known.
  15. CVE-2021-4034 Red Hat PolkitRansomware use: Unknown to Known.
  16. CVE-2020-29574 Sophos CyberoamOSRansomware use: Unknown to Known.
  17. CVE-2020-0968 Microsoft Internet ExplorerRansomware use: Unknown to Known.
  18. CVE-2020-0618 Microsoft SQL ServerRansomware use: Unknown to Known.
  19. CVE-2019-5591 Fortinet FortiOSRansomware use: Unknown to Known.
  20. CVE-2019-0803 Microsoft Win32kRansomware use: Unknown to Known.
  21. CVE-2018-0802 Microsoft OfficeRansomware use: Unknown to Known.
  22. CVE-2016-0189 Microsoft Internet ExplorerRansomware use: Unknown to Known.
  23. CVE-2026-45659 Microsoft SharePoint ServerRansomware use: Unknown to Known.
  24. CVE-2025-42999 SAP NetWeaverRansomware use: Unknown to Known.
  25. CVE-2025-8088 RARLAB WinRARRansomware use: Unknown to Known.
  26. CVE-2024-23692 Rejetto HTTP File ServerRansomware use: Unknown to Known.
  27. CVE-2025-26399 SolarWinds Web Help DeskRansomware use: Unknown to Known.
  28. CVE-2026-15410 SonicWall SMA1000 AppliancesRansomware use: Unknown to Known.
  29. CVE-2026-15409 SonicWall SMA1000 AppliancesRansomware use: Unknown to Known.
  30. CVE-2026-12569 PTC Windchill and FlexPLMRansomware use: Unknown to Known.
  31. CVE-2021-40438 ApacheRansomware use: Unknown to Known.
  32. CVE-2026-0257 Palo Alto Networks PAN-OSRansomware use: Unknown to Known.
  33. CVE-2025-3248 LangflowRansomware use: Unknown to Known.
  34. CVE-2026-33825 Microsoft DefenderRansomware use: Unknown to Known.
  35. CVE-2026-50751 Check Point Security GatewayRansomware use: Unknown to Known.
  36. CVE-2026-48027 Nx ConsoleRansomware use: Unknown to Known.
  37. CVE-2026-45321 TanStackRansomware use: Unknown to Known.
  38. CVE-2019-15107 WebminRansomware use: Unknown to Known.
  39. CVE-2013-0422 Oracle Java Runtime Environment (JRE)Ransomware use: Unknown to Known.
  40. CVE-2024-57728 SimpleHelpRansomware use: Unknown to Known.
  41. CVE-2024-57726 SimpleHelpRansomware use: Unknown to Known.
  42. CVE-2024-1708 ConnectWise ScreenConnectRansomware use: Unknown to Known.
  43. CVE-2026-41940 WebPros cPanel & WHM and WP2 (WordPress Squared)Ransomware use: Unknown to Known.
  44. CVE-2025-52691 SmarterTools SmarterMailRansomware use: Unknown to Known.
  45. CVE-2024-27199 JetBrains TeamCityRansomware use: Unknown to Known.
  46. CVE-2023-27351 PaperCut NG/MFRansomware use: Unknown to Known.
  47. CVE-2023-21529 Microsoft Exchange ServerRansomware use: Unknown to Known.
  48. CVE-2026-23760 SmarterTools SmarterMailRansomware use: Unknown to Known.
  49. CVE-2026-1731 BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA)Ransomware use: Unknown to Known.
  50. CVE-2026-24423 SmarterTools SmarterMailRansomware use: Unknown to Known.

Every change we recorded