CISA’s Known Exploited Vulnerabilities (KEV) catalogue includes a field, knownRansomwareCampaignUse, that marks entries CISA has evidence of being used in ransomware campaigns. We downloaded the catalogue’s JSON feed on 4 November 2026 (catalogue version 2026.11.03) and counted it ourselves. These are our tallies from CISA’s data, not a figure CISA publishes.
Headline numbers
| Measure | Count |
|---|---|
| Total KEV entries | 1,767 |
| Flagged “Known” for ransomware use | 361 (about 20%) |
| Entries added in 2026 | 283 |
| 2026 additions flagged “Known” | 27 (about 10%) |
| Entries added since 1 July 2026 | 137 |
| Of those, flagged “Known” | 6 |
The other entries carry the value “Unknown”. That value means CISA has not recorded ransomware use, not that none has occurred.
Which vendors dominate
Counting flagged entries by vendor, Microsoft accounts for 117 of the 361, about one third. After Microsoft come Fortinet (14), SonicWall (13), Oracle (13), Ivanti (12), Adobe (11), VMware (9), QNAP (9), Atlassian (8), Apache (8), Cisco (7) and Citrix (7). By product, Windows alone has 48 flagged entries and Exchange Server 13.
Edge and remote-access vendors are strongly represented. We grouped Fortinet, SonicWall, Ivanti, Cisco, Citrix, Palo Alto Networks, QNAP, Zyxel, Check Point and WatchGuard and found 73 flagged entries across them. That grouping is our choice and is not a CISA category.
Flagged entries by year added
| Year added to KEV | Flagged “Known” |
|---|---|
| 2021 | 84 |
| 2022 | 132 |
| 2023 | 43 |
| 2024 | 44 |
| 2025 | 31 |
| 2026 (to 3 Nov) | 27 |
Our assessment is that the 2021 and 2022 peaks partly reflect the catalogue’s early years, when many older vulnerabilities were added in bulk, so they are not a like-for-like comparison with later years. Within 2025 and 2026, 31 of 245 additions in 2025 (about 13%) and 27 of 283 in 2026 (about 10%) are flagged.
A caution on reading the decline: We found no CISA statement on how or when the flag is updated, and the feed carries no change history. Our assessment is that recent years may be undercounted today and could rise later. Our assessment is that the downward slope should not be read as ransomware actors relying less on known vulnerabilities.
The 2026 flagged entries
The 27 flagged entries added in 2026 span:
- Management and security appliances: Cisco Secure Firewall Management Center (two), Palo Alto Networks PAN-OS, Check Point Security Gateway, SonicWall SMA1000 (two), Broadcom VMware vCenter.
- Remote support and IT management tools: BeyondTrust Remote Support, ConnectWise ScreenConnect, SimpleHelp (two), SolarWinds Web Help Desk, PaperCut NG/MF.
- Email and web hosting: SmarterTools SmarterMail (three), WebPros cPanel & WHM.
- Developer tooling: JetBrains TeamCity (two), Nx Console, TanStack.
- Microsoft and enterprise software: Microsoft SharePoint, Defender, Windows and Exchange; Oracle PeopleSoft; PTC Windchill and FlexPLM.
Several are old CVEs, for example CVE-2024-1708 (ScreenConnect), CVE-2023-21529 (Exchange) and CVE-2023-27351 (PaperCut), added to KEV in 2026 and now flagged. Those CVEs were added to KEV years after disclosure and carry the flag today. The feed does not say when the ransomware evidence appeared, so we draw no conclusion on timing.
We have previously covered individual campaigns behind some of these, such as the PAN-OS CVE-2026-0257 chain and the China-nexus vCenter ransomware activity.
What defenders should do with this
- Filter KEV by the flag. Build a feed of
knownRansomwareCampaignUse = Knownentries and compare it nightly against your asset inventory. It is a short, high-signal list. - Prioritise management planes. Firewall managers, vCenter, remote-support tools and backup consoles appear repeatedly. They should have the shortest patch windows and no direct internet exposure.
- Do not ignore the “Unknown” bucket. Our assessment is that an internet-facing KEV entry on an edge device warrants action even without the flag.
- Revisit old CVEs. Re-scan for 2023 and 2024 vulnerabilities in tools such as PaperCut and ScreenConnect that may have been left unpatched on forgotten servers.
- Track flag changes. Compare successive catalogue snapshots so you notice when an existing entry is newly marked.
Method and limits
We counted entries by dateAdded year and by vendorProject, as published in the catalogue JSON. The flag reflects the catalogue as of the snapshot date. Vendor naming in the feed is not normalised (for example, a trailing space appears on one SimpleHelp entry), so small miscounts are possible. The numbers describe KEV only, not all vulnerabilities used by ransomware actors.