In the CISA KEV catalog, 361 of 1,748 entries (20.7%) carry a "Known" ransomware campaign flag. Microsoft holds 117 of them, and deserialization and path traversal flaws are the most common weaknesses among them. Recent years show a lower share, but the flag is often added later, so newer entries are likely undercounted.
Method
We downloaded the KEV catalog JSON on 19 October 2026 (version 2026.10.16). Each entry has a knownRansomwareCampaignUse field with the value Known or Unknown. We counted by dateAdded year, by vendorProject and by the CWE codes in the cwes field. For EPSS we used the values published for 18 October 2026, available for 1,747 of the 1,748 CVEs.
The flag by year added
| Year added | Entries | Flagged Known | Share |
|---|---|---|---|
| 2021 | 311 | 84 | 27% |
| 2022 | 555 | 132 | 24% |
| 2023 | 187 | 43 | 23% |
| 2024 | 186 | 44 | 24% |
| 2025 | 245 | 31 | 13% |
| 2026 | 264 | 27 | 10% |
From 2021 to 2024 the share stays near a quarter. The fall in 2025 and 2026 is probably partly real and partly timing. The field is a statement about observed use, and it can change from Unknown to Known after an entry is added. We cannot tell from one snapshot how much of the drop will be filled in later.
Who and what is flagged
The top vendors among flagged entries are Microsoft (117), Fortinet (14), SonicWall (13), Oracle (13), Ivanti (12), Adobe (11), VMware (9) and QNAP (9). The most common products are Windows (48), Exchange Server (13) and Win32k (11).
For weaknesses, the CWE codes that appear most often on flagged entries are CWE-502 deserialization (29), CWE-22 path traversal (27), CWE-20 improper input validation (26), CWE-287 improper authentication (16) and CWE-787 out of bounds write (16). That mix leans toward flaws that give a remote attacker a foothold or let them run code, which fits how ransomware operators get in.
Flagged entries score higher on EPSS
The median EPSS probability for flagged entries is 0.87. For entries without the flag it is 0.39. EPSS is a model of the chance of exploitation activity in the next 30 days, so a higher figure for flagged entries is what you would expect, but it is a comparison of two medians, not a test of cause.
What to do with this
Treat the flag as an input to ordering, not as a reason to ignore the rest. If an entry names a product you run and is flagged Known, move it ahead of other KEV items. If an entry is not flagged, that does not make it safe: Unknown means CISA has no report on file, not that ransomware groups are not using it.
Check your exposure first for internet-facing products and for remote access paths, because those are the entries where a flag most often shows up.
Safeguard's SBOM and dependency scanning lists the components you run, and reachability analysis helps separate vulnerable code your application calls from code it does not. You can try a free scan at gold.safeguard.sh/scan.
Try it yourself
Click through it at your own pace, or open it full screen.
Open an exploitability view and see how a known exploited flag changes the verdict.
Quick check
Does Unknown mean a vulnerability is not used by ransomware groups?
No. It means CISA has not recorded ransomware use. The value can change later.
Why does the flagged share drop in 2025 and 2026?
Part of it may be timing, since the flag can be set after an entry is added. One snapshot cannot separate that from a real change.
Sources
- CISA Known Exploited Vulnerabilities catalog, JSON read on 19 October 2026, catalog version 2026.10.16 (1,748 entries).
- FIRST EPSS page, EPSS values for the KEV CVEs read for 18 October 2026.
Last reviewed: 19 October 2026.
