Ransomware CVE Radar — Monthly Known-Exploited Vulnerabilities

The Nisura Team · 8 September 2026 · Updated 8 September 2026

The Ransomware CVE Radar is our live roundup of the most ransomware-relevant known-exploited vulnerabilities — drawn live from the CISA KEV catalog, filtered to CVEs flagged as ransomware-linked, and ranked by initial-access affinity (KEV ransomware flag + EPSS exploitation probability + edge-device + exploit maturity + weakness archetype), not by age or CVSS. Toggle between the most-weaponizable overall and the newest additions below.

This period: 2 newly added in the last 30 days, out of 616 ransomware-linked CVEs in KEV. · updated 8 Sept 2026

See which of these affect you

Not every entry will affect you — the point is to check against your own estate. Run a free passive scan of your domain to see the exposed vendors and services an attacker sees, then quantify the risk in euros. Want this in your inbox? Subscribe on the blog.

Method & sources

Ranking is by ransomware initial-access affinity, not CVSS or disclosure date: the KEV ransomware flag, live EPSS (30-day exploitation probability), whether it’s an edge device, corroborated exploit maturity, and the CWE weakness archetype. “Added to KEV” is when CISA listed it as known-exploited — not the CVE’s publication year. EPSS is a probability, not a certainty; a ransomware group is named only where a source is cited.

• CISA Known Exploited Vulnerabilities (KEV) catalog — the ransomware-linked flag and base universe.
• FIRST.org EPSS — 30-day exploitation probability.
• Exploit maturity from Metasploit, Exploit-DB , Nuclei templates and PoC-in-GitHub (weaponized vs. PoC).
• CIRCL Vulnerability-Lookup — EU-hosted corroboration + public sightings.
• CISA advisories (incl. #StopRansomware) and national CERTs (CERT-FR) — cited advisory references per CVE (never an auto-assigned group).
• ENISA EUVD — the EU’s own vulnerability database (EU corroboration + exploited flag).
• GreyNoise — in-the-wild active exploitation, right now.
• CISA-ADP SSVC decision points; cited CVE→ransomware-group edges.