The CISA KEV Ransomware Alert: Vulnerability Data Analysis and Exploited Insights

CISA KEV has recently merged data with stop ransomware attacks, identifying the top vulnerabilities and attack methodologies exploited in ransomware. We will deep dive into the data identifying top vendors affected by ransomware in the last year.

The Cybersecurity and Infrastructure Security Agency (CISA) recently sent an alert about a particularly menacing ransomware known as KEV.

The new section of CISA KEV is a welcomed addition to the Stop the ransom website and initiative.


The Ransomware Landscape by Numbers from CISA KEV

Let’s first lay the groundwork with some statistics. Out of 154 vendors considered, 51 have a history of ransomware incidents, while 103 have remained unscathed, at least until now. KEV ransomware is not discriminating; whether a vendor has a past with ransomware or not, all are potential targets.

(note for simplicity of visualization a number of vendors with just 1 vulnerability has been removed)

Top 10 Vendors Exposed to Ransomware in CISA KEV in the Crosshairs.

Exploited Products

Notably, the ransomware has zeroed in on some of the industry’s heavyweights. The top 10 most targeted vendors are:

  1. Microsoft
  2. VMware
  3. QNAP
  4. Oracle
  5. Adobe
  6. Apache
  7. SonicWall
  8. Accellion
  9. Atlassian

Following an overview of the vulnerable data for the top 20 products

Vendor NameCategoryRansomware DensityHas RansomNo RansomNumber products in CISA KEV# Vuln in KEV# Products NVDTotal Number of VulnMarket Cap
MicrosoftOperating System26.89%711796226481010854$2.388 T
VMwareSoftware15.69%8421351229777$66.85 B
OracleSoftware21.88%724153210809246$305.67 B
AdobeSoftware9.09%6599663364904$231.54 B
AtlassianSoftware44.44%448962417$50.87 B
FortinetOperating System6.82%340444252604$46.93 B
Red HatSoftware50.00%33560033.43 B
ZohoSoftware22.22%256947$1 Billion
F5Software50.00%22242798009.32 B

You can also explore more in-depth with our data visualization and threat intelligence explorer

Spotlight on Exploited Products and ransomware activity in CISA KEV

The products most frequently exploited give us a snapshot of the ransomware’s focus. We also compared the number of vulnerabilities reported in kev with the one affected by the ransomware activity in cisa kev, naming this ransomware density. Here are some insights:

Exploited Products
Vendors with Ransomware Density

Vulnerability in Microsoft’s Suite

  • Windows: 96 entries in CISA KEV, 459 mentions across GIT, ExploitDB, and H1.
  • Win32k: 22 CISA KEV entries, 100 mentions in exploit databases.
  • Microsoft Exchange Server: 9 CISA KEV entries, 74 mentions, two in the top 25.

Other Vendors

  • Accellion FTA: 4 CISA KEV entries, 8 mentions, 100% ransomware density.
  • Adobe Flash Player: 29 CISA KEV entries, 87 mentions, 10.34% ransomware density.
  • Oracle Java SE: 7 CISA KEV entries, 17 mentions, 42.86% ransomware density.

Ransomware Density and Vulnerability

  • Microsoft’s Exchange Server has a staggering 66.67% ransomware density.
  • Accellion’s FTA and QNAP’s Photo Station both have a 100% ransomware density, indicating all their vulnerabilities are exploited by ransomware.

(note for simplicity of visualization a number of vendors with just 1 vulnerability has been removed)

Defensive Measures for Organizations

  1. Regular Software Updates: An outdated system is an open field for cyber predators.
  2. Leverage CISA KEV to identify and prioritize vulnerabilities.
  3. Implement a selection and prioritization method like risk based vulnerability prioritization and SSVC for selecting vulnerability based on indicator of compromise.
  4. Multi-Factor Authentication (MFA): Implement MFA to add layer of security.
  5. Segment network in line with Zero Trust principle to prevent a compromised host to extend the infection to other compromised hosts

Why You Should Refer to CISA’s StopRansomware Website

CISA’s StopRansomware website is a treasure trove of information on misconfigurations and weaknesses that are commonly exploited in ransomware campaigns. This platform serves as a one-stop resource for recognizing and rectifying vulnerabilities that KEV ransomware and its ilk are known to exploit.

Another interesting report to consider is the cisa top routinely exploited vulnerabilities

What are the top vendors mentioned in CISA Top Exploited Vulnerability 2022

  • VMware,
  • Atlassian,
  • Microsoft,
  • Fortinet,
  • F5,
  • Zoho,
  • Apache,
  • SonicWall,
  • Zimbra,
  • SAP,
  • Oracle

What are the top exploits in the CISA Top exploited Vulnerabilities 2022

  • 🛡️ CVE-2018-13379: Affects Fortinet SSL VPNs. The issue lies in failing to patch software, making organizations vulnerable.
  • 📧 CVE-2021-34473, CVE-2021-31207, CVE-2021-34523 (ProxyShell): Targets Microsoft Exchange email servers. Enables remote actors to execute arbitrary code.
  • 🔐 CVE-2021-40539: Impacts Zoho ManageEngine ADSelfService Plus. Enables unauthenticated remote code execution due to outdated third-party dependency.
  • 🤝 CVE-2021-26084: Affects Atlassian Confluence Server and Data Center. Allows unauthenticated cyber actors to execute arbitrary code.
  • 📚 CVE-2021-44228 (Log4Shell): Affects Apache’s Log4j library. Enables the execution of arbitrary code and system control.
  • 💻 CVE-2022-22954, CVE-2022-22960: Affects VMware Workspace ONE Access and other VMware products. Allows remote code execution, privilege escalation, and authentication bypass.

What are the top Method of Attacks in the CISA Top exploited Vulnerabilities

  • RCE (Remote Code Execution): 16 Mentions
  • RCE/Authentication Bypass: 1 Mention
  • Arbitrary Code Execution: 4 Mentions
  • Security Feature Bypass: 1 Mention
  • Elevation of Privilege: 2 Mentions
  • Privilege Escalation: 2 Mentions
  • Server Path Traversal: 2 Mentions
  • SSL VPN Credential Exposure: 1 Mention

In the new report for 2022, CISA Top routinely exploited vulnerabilities  identifies the top routinely exploited vulnerabilities:

Note: The post has an embedded script and iframe to interact with the data directly. Make sure you have those enabled (on mobile, one of the visuals will ask to download a file, ignore this)

CISA, Top Exploitable Vulnerabilities, 2022, Vulnerability management, CVE, EPSS, Top 2022 Exploitable Vulnerabilities


The CISA KEV ransomware alert as well as CISA KEV catalogues, are two great indicators of compromise and should be taken into consideration when prioritizing vulnerabilities. An alternative measure are EPSS, which helps organizations prioritise based on an observed vulnerability in the wild.
Phoenix security leverages CISA KEV, Ransomware indicators, and evidence of exploitability to alert immediately when a vulnerability and an asset can be compromised

How Phoenix Security Can Help

attack graph phoenix security

Phoenix Security helps organizations identify and trace which systems have vulnerabilities, understanding the relation between code and cloud. One of the significant challenges in securing applications is knowing where and how frameworks like Struts are used. ASPM tools can scan the application portfolio to identify instances of Struts, mapping out where it is deployed across the organization. This information is crucial for targeted security measures and efficient patch management. Phoenix Security’s robust Application Security Posture Management (ASPM) system is adept at not just managing, but preempting the exploitation of vulnerabilities through its automated identification system. This system prioritises critical vulnerabilities, ensuring that teams can address the most pressing threats first, optimising resource allocation and remediation efforts.

The Role of Application Security Posture Management (ASPM):

ASPM plays a vital role in managing and securing applications like those built with Apache Struts. It involves continuous assessment, monitoring, and improvement of the security posture of applications. ASPM tools can:

  1. Identify and Track Struts Components: Locate where Struts is implemented within the application infrastructure.
  2. Vulnerability Management: Detect known vulnerabilities in Struts and prioritize them for remediation.
  3. Configuration Monitoring: Ensure Struts configurations adhere to best security practices.
  4. Compliance: Check if the usage of Struts aligns with relevant cybersecurity regulations and standards.

By leveraging Phoenix Security, you not only unravel the potential threats but also take a significant stride in vulnerability management, ensuring your application security remains up to date and focuses on the key vulnerabilities.

Get an overview of your asset lineage

Francesco is an internationally renowned public speaker, with multiple interviews in high-profile publications (eg. Forbes), and an author of numerous books and articles, who utilises his platform to evangelize the importance of Cloud security and cutting-edge technologies on a global scale.

Discuss this blog with our community on Slack

Join our AppSec Phoenix community on Slack to discuss this blog and other news with our professional security team

From our Blog

Explore ASPM’s role in modern application security, offering a panoramic view that extends beyond code vulnerabilities. This guide demystifies concepts like traceability, reachability analysis, and asset lineage, pivotal for securing digital assets. Learn how ASPM empowers organizations with actionable insights for precise vulnerability management. #Cybersecurity #ASPM #ApplicationSecurity
Francesco Cipollone
Explore the transformative role of ASPM in cybersecurity. Uncover how Application Security Posture Management aligns business and security objectives for effective vulnerability management and risk reduction. Discover Phoenix Security’s innovative approach to tackling the staggering challenge of CVEs with a strategic focus on prioritization. #ASPM #Cybersecurity #VulnerabilityManagement
Francesco Cipollone
Explore the critical insights into the latest container security vulnerabilities named leaky vessels, including CVE-2024-21626, CVE-2024-23651, CVE-2024-23653, and CVE-2024-23652, BuildKit flaws, with our comprehensive guide on mitigation strategies, best practices for application security, and tips for robust vulnerability management in Docker and Kubernetes environments. Stay ahead in securing your container deployments against potential threats with ASPM help
Francesco Cipollone

Jeevan Singh

Founder of Manicode Security

Jeevan Singh is the Director of Security Engineering at Rippling, with a background spanning various Engineering and Security leadership roles over the course of his career. He’s dedicated to the integration of security practices into software development, working to create a security-aware culture within organizations and imparting security best practices to the team.
In his role, Jeevan handles a range of tasks, from architecting security solutions to collaborating with Engineering Leadership to address security vulnerabilities at scale and embed security into the fabric of the organization.

James Berthoty

Founder of Latio Tech

James Berthoty has over ten years of experience across product and security domains. He founded Latio Tech to help companies find the right security tools for their needs without vendor bias.

Christophe Parisel

Senior Cloud Security Architect

Senior Cloud Security Architect

Chris Romeo

Security Journey

Chris Romeo is a leading voice and thinker in application security, threat modeling, and security champions and the CEO of Devici and General Partner at Kerr Ventures. Chris hosts the award-winning “Application Security Podcast,” “The Security Table,” and “The Threat Modeling Podcast” and is a highly rated industry speaker and trainer, featured at the RSA Conference, the AppSec Village @ DefCon, OWASP Global AppSec, ISC2 Security Congress, InfoSec World and All Day DevOps. Chris founded Security Journey, a security education company, leading to an exit in 2022. Chris was the Chief Security Advocate at Cisco, spreading security knowledge through education and champion programs. Chris has twenty-six years of security experience, holding positions across the gamut, including application security, security engineering, incident response, and various Executive roles. Chris holds the CISSP and CSSLP certifications.

Jim Manico

Founder of Manicode Security

Jim Manico is the founder of Manicode Security, where he trains software developers on secure coding and security engineering. Jim is also the founder of Brakeman Security, Inc. and an investor/advisor for Signal Sciences. He is the author of Iron-Clad Java: Building Secure Web Applications (McGraw-Hill), a frequent speaker on secure software practices, and a member of the JavaOne Rockstar speaker community. Jim is also a volunteer for and former board member of the OWASP foundation.

Join our Mailing list!

Get all the latest news, exclusive deals, and feature updates.