In the CISA Known Exploited Vulnerabilities (KEV) catalog, version 2026.10.08, 361 of 1739 entries (20.8 percent) carry the value “Known” in the ransomware field. Mail, collaboration and file transfer servers have the highest share by product class, at 38.7 percent, followed by IT management tools at 33.3 percent. Flagged entries also have a much higher median EPSS score than the rest.
- 361KEV entries flagged “Known” out of 1739Source: CISA KEV catalog, version 2026.10.08; FIRST EPSS, score date 2026-10-08
- 20.8%Share of all entries flagged “Known”Source: CISA KEV catalog, version 2026.10.08; FIRST EPSS, score date 2026-10-08
- 0.86633Median EPSS score of flagged entriesSource: CISA KEV catalog, version 2026.10.08; FIRST EPSS, score date 2026-10-08
- 0.39337Median EPSS score of entries marked “Unknown”Source: CISA KEV catalog, version 2026.10.08; FIRST EPSS, score date 2026-10-08
What does the ransomware field in KEV mean?
Each KEV entry has a field called knownRansomwareCampaignUse. Its value is either “Known” or “Unknown”. The pages we saved for this study do not define the field, so we only report that the catalog carries it. “Unknown” does not mean the vulnerability was never used by ransomware operators.
For background on the catalog itself, see the known exploited vulnerabilities entry and the ransomware entry in our glossary.
How does the flagged share change by year?
We grouped entries by the year they were added to the catalog. The share flagged “Known” was 27.0 percent in 2021 and 10.6 percent in 2026. From 2022 to 2024 the share stays between 23.0 and 23.8 percent. It then drops to 12.7 percent for 2025.
| Year added | Entries | Flagged “Known” | Share |
|---|---|---|---|
| 2021 | 311 | 84 | 27.0% |
| 2022 | 555 | 132 | 23.8% |
| 2023 | 187 | 43 | 23.0% |
| 2024 | 186 | 44 | 23.7% |
| 2025 | 245 | 31 | 12.7% |
| 2026 | 255 | 27 | 10.6% |
This is a limit, not a finding. Recent entries have had less time to be tagged. A vulnerability added in 2026 may still be linked to ransomware later, so the fall in the table does not show that ransomware use of new vulnerabilities is falling.
Which product classes carry the highest share?
We sorted entries into product classes with our own keyword rules, described in our post on KEV additions by product type. The classes are a heuristic, and one entry sits in one class. Mail, collaboration and file transfer servers (48 of 124) and IT management and remote access tools (40 of 120) lead. Browsers are lowest at 6.0 percent.
| Product class | Entries | Flagged | Share |
|---|---|---|---|
| Mail, collaboration and file transfer servers | 124 | 48 | 38.7% |
| IT management and remote access tools | 120 | 40 | 33.3% |
| Other or unclassified | 382 | 83 | 21.7% |
| Network edge devices | 291 | 63 | 21.6% |
| Web applications, CMS and frameworks | 174 | 36 | 20.7% |
| Operating systems and mobile platforms | 342 | 62 | 18.1% |
| Cameras, NAS and other IoT | 39 | 5 | 12.8% |
| Office and document software | 118 | 15 | 12.7% |
| Browsers | 149 | 9 | 6.0% |
Which products and weaknesses appear most among flagged entries?
Microsoft Windows has the most flagged entries, 48. Microsoft Exchange Server follows with 13 and Microsoft Win32k with 11. Palo Alto Networks PAN-OS, Fortinet FortiOS and Microsoft Internet Explorer have 6 each. Microsoft SharePoint, Synacor Zimbra Collaboration Suite and Adobe Flash Player have 5 each. JetBrains TeamCity, Veeam Backup & Replication and the catalog name “Fortinet FortiOS and FortiProxy” have 4 each. Product names are counted as the catalog writes them, so the two Fortinet names are separate rows.
Three of the vendors named here have a flaw with its own page: TeamCity (CVE-2024-27198), FortiOS (CVE-2024-21762) and PAN-OS (CVE-2024-3400). The PaperCut NG and MF flaw (CVE-2023-27350) is also flagged.
For weaknesses, the flagged entries most often list CWE-502, deserialization of untrusted data (29), CWE-22, path traversal (27) and CWE-20, improper input validation (26). CWE-287 improper authentication and CWE-787 out-of-bounds write follow with 16 each. CWE-306 missing authentication for a critical function has 13, CWE-78 OS command injection 12 and CWE-94 code injection 11. For the wider CWE picture, see KEV weakness classes, 2024 to 2026. Many of these weaknesses map to exploitation of public-facing applications, though the catalog does not tell us how any single ransomware group got in.
Are flagged vulnerabilities older?
Partly. 126 of the 361 flagged entries have a CVE ID from 2019 or earlier. But the delay from CVE publication to KEV listing is not longer for flagged entries. The median is 217 days for flagged entries and 260 days for the 1378 others. The middle half runs from 13 to 1029 days for flagged entries and from 7 to 1436 days for the others. So age alone does not separate the two groups. Our post on EPSS scores of KEV vulnerabilities covers the score side.
Do flagged entries have higher EPSS scores?
Yes. The median EPSS score is 0.86633 for flagged entries and 0.39337 for entries marked “Unknown”. The median for all 1739 KEV entries is 0.49083. We used the file with score date 2026-10-08, model version v2026.06.15. The scores and the flag are produced separately, so this is a link between two measures, not proof that one causes the other. Teams that track EPSS alongside patch management may ask whether the vulnerabilities on their list sit in the classes above.
Method
We downloaded the CISA KEV catalog, catalogVersion 2026.10.08, on 2026-10-09 and counted entries by the value of knownRansomwareCampaignUse. Entries were grouped by the year they were added and by product class. Time to listing is the number of days from CVE publication, taken from the CVE Program records, to the date added to KEV. Some values are negative, which means the listing came before the CVE record was published. EPSS scores come from the FIRST file with score date 2026-10-08.
Limits
The field says what the catalog records, not what every ransomware group does. “Unknown” is not “no use”. Recent entries have had less time to be tagged. Product classes come from our own keyword rules. Correlation between the flag and EPSS is not cause. The data cannot show how many victims were affected, or which groups used which vulnerability.
For the deadlines CISA attaches to listed entries, see KEV due-date windows and pace of additions.