Vulnerabilities exploited by ransomware groups

Every vulnerability we can tie to a ransomware group we track, ranked by how urgently a defender should care: catalogued exploitation first, then predicted exploitation, then severity. 82 of 91 are in the CISA Known Exploited Vulnerabilities catalog.

CVE	Affected	Severity	EPSS	Groups
CVE-2021-44228 KEV Apache Log4j CRITICAL10	Apache Log4j	CRITICAL 10	100%	Dragonforce
CVE-2025-53770 KEV MS Server Products SharePoint Server CRITICAL9.8	MS Server Products SharePoint Server	CRITICAL 9.8	100%	Warlock
CVE-2023-27350 KEV PaperCut Application Server CRITICAL9.8	PaperCut Application Server	CRITICAL 9.8	100%	Clop
CVE-2024-21887 KEV Ivanti ICS CRITICAL9.1	Ivanti ICS	CRITICAL 9.1	100%	Dragonforce
CVE-2024-21893 KEV Pulse Secure / Ivanti Ivanti Connect Secure HIGH8.2	Pulse Secure / Ivanti Ivanti Connect Secure	HIGH 8.2	100%	Dragonforce
CVE-2025-49704 KEV MS Server Products SharePoint Server HIGH8.8	MS Server Products SharePoint Server	HIGH 8.8	100%	Warlock
CVE-2023-46604 KEV Apache ActiveMQ CRITICAL10	Apache ActiveMQ	CRITICAL 10	100%	Ransomhub
CVE-2022-40684 KEV Fortinet FortiOS CRITICAL9.8	Fortinet FortiOS	CRITICAL 9.8	100%	Akira
CVE-2023-46805 KEV Pulse Secure / Ivanti Ivanti Connect Secure HIGH8.2	Pulse Secure / Ivanti Ivanti Connect Secure	HIGH 8.2	100%	Dragonforce
CVE-2024-1709 KEV ConnectWise ScreenConnect CRITICAL10	ConnectWise ScreenConnect	CRITICAL 10	100%	Blackbasta
CVE-2025-5777 KEV Citrix NetScaler ADC & Gateway HIGH7.5	Citrix NetScaler ADC & Gateway	HIGH 7.5	100%	Dragonforce
CVE-2023-34362 KEV Progress Software MOVEit CRITICAL9.8	Progress Software MOVEit	CRITICAL 9.8	99.9%	Clop
CVE-2021-21972 KEV VMware vSphere Client CRITICAL9.8	VMware vSphere Client	CRITICAL 9.8	99.9%	Akira
CVE-2021-34527 KEV Windows Print Spooler HIGH8.8	Windows Print Spooler	HIGH 8.8	99.8%	Blackbasta
CVE-2023-3519 KEV Citrix NetScaler ADC & Gateway CRITICAL9.8	Citrix NetScaler ADC & Gateway	CRITICAL 9.8	99.7%	Ransomhub
CVE-2025-55182 KEV Meta react-server-dom-webpack CRITICAL10	Meta react-server-dom-webpack	CRITICAL 10	99.7%	Thegentlemen
CVE-2025-61882 KEV Oracle Corporation Oracle Concurrent Processing CRITICAL9.8	Oracle Corporation Oracle Concurrent Processing	CRITICAL 9.8	99.7%	Clop, Sinobi, Shinyhunters
CVE-2025-31324 KEV SAP NetWeaver Visual Composer CRITICAL10	SAP NetWeaver Visual Composer	CRITICAL 10	99.5%	Qilin
CVE-2024-21412 KEV Windows SmartScreen HIGH8.1	Windows SmartScreen	HIGH 8.1	99.4%	Thegentlemen, Dragonforce
CVE-2020-1472 KEV Windows NetLogon MEDIUM5.5	Windows NetLogon	MEDIUM 5.5	99.4%	Ransomhub, Blackbasta
CVE-2023-22515 KEV Atlassian Confluence Data Center & Server CRITICAL9.8	Atlassian Confluence Data Center & Server	CRITICAL 9.8	99.2%	Ransomhub
CVE-2017-0144 KEV Windows SMBv1 HIGH8.8	Windows SMBv1	HIGH 8.8	99.2%	Ransomhub, Thegentlemen
CVE-2022-30190 KEV Windows MSDT HIGH7.8	Windows MSDT	HIGH 7.8	99.2%	Blackbasta
CVE-2025-49706 KEV MS Server Products SharePoint Server MEDIUM6.5	MS Server Products SharePoint Server	MEDIUM 6.5	99.1%	Warlock
CVE-2026-24061 KEV Telnet Telnetd in GNU Inetutils CRITICAL9.8	Telnet Telnetd in GNU Inetutils	CRITICAL 9.8	99%	Qilin
CVE-2025-32433 KEV erlang otp CRITICAL10	erlang otp	CRITICAL 10	98.9%	Thegentlemen
CVE-2024-50623 KEV Cleo MFT Solutions (Harmony, VLTrader, LexiCom) CRITICAL9.8	Cleo MFT Solutions (Harmony, VLTrader, LexiCom)	CRITICAL 9.8	98.6%	Clop
CVE-2026-41940 KEV WebPros cPanel CRITICAL9.8	WebPros cPanel	CRITICAL 9.8	98.5%	Thegentlemen
CVE-2023-48788 KEV Fortinet FortiClient CRITICAL9.8	Fortinet FortiClient	CRITICAL 9.8	98.4%	Akira, Ransomhub
CVE-2024-57727 KEV SimpleHelp RMM HIGH7.5	SimpleHelp RMM	HIGH 7.5	96.8%	Dragonforce, Medusa
CVE-2023-46747 KEV F5 BIG-IP CRITICAL9.8	F5 BIG-IP	CRITICAL 9.8	96.7%	Ransomhub
CVE-2026-35273 KEV Oracle PeopleSoft (PeopleTools) CRITICAL9.8	Oracle PeopleSoft (PeopleTools)	CRITICAL 9.8	96.7%	Shinyhunters
CVE-2026-23760 KEV SmarterTools SmarterMail CRITICAL9.8	SmarterTools SmarterMail	CRITICAL 9.8	96.4%	Warlock
CVE-2024-1708 KEV ConnectWise ScreenConnect HIGH8.4	ConnectWise ScreenConnect	HIGH 8.4	95.4%	Rhysida, Spacebears, Direwolf, +2
CVE-2024-53704 KEV SonicWall SSL VPN CRITICAL9.8	SonicWall SSL VPN	CRITICAL 9.8	95.3%	Sinobi
CVE-2024-55591 KEV Fortinet FortiOS & FortiProxy CRITICAL9.8	Fortinet FortiOS & FortiProxy	CRITICAL 9.8	94.4%	Qilin, Thegentlemen, Dragonforce
CVE-2026-35616 KEV Fortinet FortiClientEMS CRITICAL9.8	Fortinet FortiClientEMS	CRITICAL 9.8	94%	Thegentlemen
CVE-2024-55956 KEV Cleo VLTrader, Harmony, LexiCom CRITICAL9.8	Cleo VLTrader, Harmony, LexiCom	CRITICAL 9.8	94%	Clop
CVE-2026-1731 KEV BeyondTrust Remote Support / Privileged Remote Access CRITICAL9.8	BeyondTrust Remote Support / Privileged Remote Access	CRITICAL 9.8	93.9%	Medusa
CVE-2025-9242 KEV WatchGuard Fireware OS CRITICAL9.8	WatchGuard Fireware OS	CRITICAL 9.8	92.2%	Qilin
CVE-2024-40711 KEV Veeam Backup & Replication CRITICAL9.8	Veeam Backup & Replication	CRITICAL 9.8	90.4%	Akira
CVE-2026-42208 KEV BerriAI litellm CRITICAL9.8	BerriAI litellm	CRITICAL 9.8	89.4%	Thegentlemen
CVE-2026-9082 KEV Drupal core CRITICAL9.8	Drupal core	CRITICAL 9.8	89.4%	Thegentlemen
CVE-2026-20079 KEV Cisco Secure Firewall Management Center (FMC) CRITICAL10	Cisco Secure Firewall Management Center (FMC)	CRITICAL 10	88.7%	Qilin
CVE-2026-24423 KEV SmarterTools SmarterMail CRITICAL9.8	SmarterTools SmarterMail	CRITICAL 9.8	88.2%	Qilin
CVE-2023-27997 KEV Fortinet FortiOS SSL-VPN & FortiProxy CRITICAL9.8	Fortinet FortiOS SSL-VPN & FortiProxy	CRITICAL 9.8	86.8%	Ransomhub
CVE-2026-50751 KEV Check Point VPN Remote Access and Mobile Access CRITICAL9.3	Check Point VPN Remote Access and Mobile Access	CRITICAL 9.3	85.3%	Qilin, Rhysida, Spacebears, +3
CVE-2021-1675 KEV Windows Print Spooler HIGH7.8	Windows Print Spooler	HIGH 7.8	85.3%	Blackbasta
CVE-2024-21762 KEV Fortinet FortiOS & FortiProxy CRITICAL9.8	Fortinet FortiOS & FortiProxy	CRITICAL 9.8	84.6%	Qilin, Dragonforce
CVE-2025-40551 KEV SolarWinds Web Help Desk CRITICAL9.8	SolarWinds Web Help Desk	CRITICAL 9.8	84.2%	Warlock
CVE-2025-33073 KEV Microsoft Windows 10 Version 1507 HIGH8.8	Microsoft Windows 10 Version 1507	HIGH 8.8	82.8%	Thegentlemen
CVE-2023-27532 KEV Veeam Backup & Replication HIGH7.5	Veeam Backup & Replication	HIGH 7.5	80.6%	Akira
CVE-2026-45659 KEV MS Server Products SharePoint Server HIGH8.8	MS Server Products SharePoint Server	HIGH 8.8	80.2%	Warlock
CVE-2023-27351 KEV PaperCut Application Server HIGH7.5	PaperCut Application Server	HIGH 7.5	78.1%	Clop
CVE-2021-42287 KEV Windows Active Directory HIGH7.5	Windows Active Directory	HIGH 7.5	77.2%	Blackbasta
CVE-2021-42278 KEV Microsoft Windows Server 2019 HIGH7.5	Microsoft Windows Server 2019	HIGH 7.5	73.3%	Blackbasta
CVE-2020-3259 KEV Cisco ASA & FTD HIGH7.5	Cisco ASA & FTD	HIGH 7.5	71.5%	Akira
CVE-2025-59718 KEV Fortinet FortiOS CRITICAL9.8	Fortinet FortiOS	CRITICAL 9.8	68.1%	Qilin
CVE-2024-57726 KEV SimpleHelp RMM CRITICAL9.9	SimpleHelp RMM	CRITICAL 9.9	66.4%	Dragonforce
CVE-2024-57728 KEV SimpleHelp RMM HIGH7.2	SimpleHelp RMM	HIGH 7.2	64.5%	Dragonforce
CVE-2023-21529 KEV Microsoft Exchange Server HIGH8.8	Microsoft Exchange Server	HIGH 8.8	59.3%	Rhysida, Spacebears, Direwolf, +2
CVE-2021-27104 KEV Accellion File Transfer Appliance CRITICAL9.8	Accellion File Transfer Appliance	CRITICAL 9.8	56.7%	Clop
CVE-2025-14611 KEV CentreStack Gladinet CentreStack CRITICAL9.8	CentreStack Gladinet CentreStack	CRITICAL 9.8	53.3%	Warlock
CVE-2026-12569 KEV PTC Windchill PDMLink / FlexPLM CRITICAL9.8	PTC Windchill PDMLink / FlexPLM	CRITICAL 9.8	46%	Clop
CVE-2026-20131 KEV Cisco Secure Firewall Management Center (FMC) CRITICAL10	Cisco Secure Firewall Management Center (FMC)	CRITICAL 10	44.4%	Interlock, Panzer
CVE-2020-0787 KEV Windows BITS HIGH7.8	Windows BITS	HIGH 7.8	42.5%	Ransomhub
CVE-2024-38178 KEV Microsoft Windows Scripting Engine HIGH7.5	Microsoft Windows Scripting Engine	HIGH 7.5	41.4%	Tengu
CVE-2025-14733 KEV WatchGuard Fireware OS CRITICAL9.8	WatchGuard Fireware OS	CRITICAL 9.8	29.4%	Qilin
CVE-2024-37085 KEV VMware ESXi MEDIUM6.8	VMware ESXi	MEDIUM 6.8	26.8%	Akira, Blackbasta
CVE-2023-20269 KEV Cisco ASA & FTD MEDIUM5	Cisco ASA & FTD	MEDIUM 5	26.6%	Akira
CVE-2024-40766 KEV SonicWall SonicOS SSL-VPN CRITICAL9.8	SonicWall SonicOS SSL-VPN	CRITICAL 9.8	18.4%	Akira, Dragonforce, Sinobi
CVE-2026-15410 KEV SonicWall SMA1000 HIGH7.2	SonicWall SMA1000	HIGH 7.2	11.8%	Incransom
CVE-2021-27103 KEV Accellion File Transfer Appliance CRITICAL9.8	Accellion File Transfer Appliance	CRITICAL 9.8	11.4%	Clop
CVE-2026-63030 KEV WordPress WordPress CRITICAL9.8	WordPress WordPress	CRITICAL 9.8	10.6%	Thegentlemen
CVE-2026-15409 KEV SonicWall SMA1000 CRITICAL10	SonicWall SMA1000	CRITICAL 10	6.8%	Incransom, Thegentlemen
CVE-2019-6693 KEV Fortinet FortiOS MEDIUM6.5	Fortinet FortiOS	MEDIUM 6.5	6.6%	Akira
CVE-2021-27101 KEV Accellion File Transfer Appliance CRITICAL9.8	Accellion File Transfer Appliance	CRITICAL 9.8	6%	Clop
CVE-2025-60710 KEV Microsoft Windows HIGH7.8	Microsoft Windows	HIGH 7.8	4.6%	Rhysida, Spacebears, Direwolf, +1
CVE-2026-20045 KEV Cisco Unified Communications HIGH8.2	Cisco Unified Communications	HIGH 8.2	4.5%	Shinyhunters
CVE-2024-26169 KEV Windows Error Reporting Service HIGH7.8	Windows Error Reporting Service	HIGH 7.8	4%	Blackbasta
CVE-2021-27102 KEV Accellion File Transfer Appliance HIGH7.8	Accellion File Transfer Appliance	HIGH 7.8	3.7%	Clop
CVE-2026-48027 KEV Nx Console CRITICAL9.8	Nx Console	CRITICAL 9.8	1.9%	Rhysida, Spacebears, Direwolf, +1
CVE-2025-53771 MS Server Products SharePoint Server MEDIUM6.5	MS Server Products SharePoint Server	MEDIUM 6.5	99.9%	Warlock
CVE-2025-40554 SolarWinds Web Help Desk CRITICAL9.8	SolarWinds Web Help Desk	CRITICAL 9.8	60.6%	Qilin
CVE-2025-60021 Apache bRPC CRITICAL9.8	Apache bRPC	CRITICAL 9.8	25.7%	Qilin
CVE-2025-55754 Apache Software Foundation Apache Tomcat CRITICAL9.6	Apache Software Foundation Apache Tomcat	CRITICAL 9.6	10.3%	Tengu
CVE-2026-19118 GitHub Enterprise Server HIGH7.5	GitHub Enterprise Server	HIGH 7.5	0.9%	Payload
CVE-2025-43995 DSM Data Collector CRITICAL9.8	DSM Data Collector	CRITICAL 9.8	0.8%	Tengu
CVE-2026-4681 PTC Windchill PDMLink CRITICAL9.3	PTC Windchill PDMLink	CRITICAL 9.3	0.7%	Clop
CVE-2023-20263 Cisco ASA & FTD MEDIUM4.7	Cisco ASA & FTD	MEDIUM 4.7	0.6%	Akira
CVE-2025-1055 K7 Computing K7RKScan.sys driver (BYOVD) MEDIUM5.6	K7 Computing K7RKScan.sys driver (BYOVD)	MEDIUM 5.6	0.2%	Warlock

Exploitation is attributed to a group across its recorded activity, not to any individual victim. Severity and description come from NVD, exploitation probability from FIRST EPSS, and catalogue status from CISA. Group attribution comes from ransomware.live.