Ransomware's toolkit

Which exploited vulnerabilities do ransomware crews use, and how quickly?

270 of the 1,429 vulnerabilities CISA confirmed exploited in 2022 to 2026 are ones it knows ransomware campaigns have used. Operating systems are the largest group among them (61), and Microsoft, Oracle and Fortinet the vendors with the most.

What this means for you

23% of the ransomware-linked flaws in 2022 to 2026 are in the operating systems class, and 18% in the network edge class. Treat a ransomware-linked KEV entry in your estate as an incident-level priority: patch or isolate it first, then check for signs it was already used.

Do this next

Patch ransomware-linked KEV entries first

This chapter's program actions come with a subscription

Start free and set your program

270

Ransomware-linked

of 1,429 confirmed exploited

19%

Share of exploited

2022 to 2026

Operating systems

Largest class

23% of ransomware-linked

Median days, ransomware-linked

5 days for the rest

a. Where

Which classes and vendors ransomware crews use

Ransomware-linked flaws by product class and by vendor. Click a bar to open those CVEs.

Ransomware-linked flaws by product class

Operating systems make up 23% of the ransomware-linked flaws (61 of 270).

Sources: CISA Known Exploited Vulnerabilities catalog

Table view


Operating systems	61	23%
Network edge	49	18%
Web and application servers and frameworks	45	17%
Email and collaboration	31	11%
IT and security management	20	7%
Browsers and plug-ins	17	6%
Network devices	14	5%
Virtualization and backup	11	4%
File transfer	10	4%
Office and document software	7	3%
Other	5	2%

How this is calculated

Ransomware-linked means CISA's catalog field "Known ransomware campaign use" reads Known: CISA has evidence a ransomware campaign used the flaw. CISA can set the field after listing, so recent entries may be under-counted. Counted in the year CISA confirmed exploitation; classes from the site's classifier (lib/cve-analysis/product-class.ts, version 2026-10-15.1). The speed comparison uses CVEs published after the catalog launched (2021-11-03) and confirmed in these years; medians from 5 CVEs.

Ransomware-linked flaws by vendor (top 10)

Microsoft (78), Oracle (13) and Fortinet (11) have the most ransomware-linked flaws in these years.

A count of confirmed ransomware use against widely deployed products, not a security rating.

Subscriber feature · $5 a month or $50 a year

Read the rest of Chapter 12: Ransomware's toolkit

The findings, every chart with drill-down to the reports behind it, and what to do about it, recalculated for any state, entity type or year range you choose. Unlock all 14 chapters with a subscription.

Ransomware-linked flaws over time, and how fast they were used
What this means for your program: 3 key points
4 program actions mapped to HIPAA and NIST CSF 2.0, starting with “Patch ransomware-linked KEV entries first”
Exam angle for 5 CISSP, CISM and CISA domains, with a study prompt

Start free Or subscribe for $5 a month

Included with an ExamPrep subscription or as a DueCare site administrator. How linking works