Why Ransomware Uses Old CVEs (and Why the Newest Isn’t the Most Dangerous)

The Nisura Team · 10 September 2026

If you look at our live ransomware CVE radar, you’ll notice something that seems wrong at first: some of the top vulnerabilities are years old. A 2022 firewall flaw sits above a brand-new 2026 CVE. That isn’t a bug or stale data — it’s the single most important truth about how ransomware actually breaks in. The newest vulnerability is rarely the most dangerous one, and ranking by age (or by CVSS score) hides the ones attackers are really using.

What the radar ranks by — and what it deliberately ignores

The radar orders ransomware-linked CVEs by an initial-access affinity score, not by publication date. That score combines the signals that actually predict a break-in:

• CISA KEV — is the CVE in the Known Exploited Vulnerabilities catalogue, i.e. confirmed exploited in the wild?
• EPSS (FIRST.org) — the data-driven probability it will be exploited in the next 30 days.
• Edge exposure — is it on an internet-facing device (VPN, firewall, file-transfer or virtualisation appliance) an attacker can reach?
• Public exploit — does a working, weaponised exploit exist (Exploit-DB, Metasploit, Nuclei)?
• Ransomware use — is it flagged as used in ransomware campaigns, with cited group attribution where available?

Notice what’s not in that list: the year in the CVE ID. Age is not a risk signal. A vulnerability doesn’t become safer because it’s old, and it isn’t dangerous because it’s new — it’s dangerous because it’s exposed and being exploited.

Why ransomware prefers old, proven CVEs

Zero-days make headlines, but they’re the exception, not the rule. Ransomware — especially the ransomware-as-a-service (RaaS) affiliate model — optimises for reliable, repeatable access at scale, and old vulnerabilities win on every axis that matters to an attacker:

• They’re cheap and reliable. A zero-day is expensive to acquire and perishable — it burns the moment it’s used and patched. A proven, public exploit for a known CVE costs nothing and works every time it finds an unpatched target.
• The targets are still there. Edge devices are notoriously slow to patch — they’re operationally sensitive, sometimes forgotten, often exposed “temporarily” and never locked down. Years after disclosure, tens of thousands of vulnerable appliances are still reachable on the internet.
• It scales. An affiliate can mass-scan the internet for one known-vulnerable appliance and monetise every hit. Novel exploitation is artisanal; known-CVE exploitation is industrial.

This is exactly what CISA found in its vulnerability review: most damaging intrusions begin with a known, already-catalogued vulnerability on an internet-facing system — not a novel zero-day. We wrote about that finding in attackers exploit your known, exposed weaknesses. Verizon’s DBIR tells the same story: exploitation of edge and exposed devices is a large and growing share of initial access.

The data: newest ≠ most dangerous

Here’s the pattern in practice, using entries from the radar. Watch what happens when you sort by exploitation instead of age:

The oldest vulnerability in that list is one of the two most dangerous. The newest is mid-pack. And a fairly recent CVE (Proxmox) sits near the bottom because, despite being on KEV, it isn’t weaponised and its EPSS is tiny. If we sorted this list by date, we’d put the least exploited CVE at the top and bury the firewall flaw that’s actually breaking into networks.

Why CVSS and “latest CVEs” both mislead

Two habits keep security teams looking in the wrong place:

• CVSS is severity, not likelihood. A CVSS 9.8 tells you how bad it would be if exploited — not whether anyone is exploiting it. Rank by CVSS and you get thousands of “criticals” with no way to choose. Most never get weaponised; a few define your entire year.
• Recency is vanity. A feed of the “latest CVEs” is optimised for looking current, not for reducing risk. The newest CVE almost by definition has the least exploitation data — low EPSS, no public exploit yet — so a recency-ranked view systematically shows you the least actionable vulnerabilities.

The honest alternative is to rank by real-world exploitation: KEV (is it exploited?) × EPSS (how likely, how soon?) × exposure (can an attacker reach it?). That’s the logic behind CISA’s SSVC “Act / Attend / Track” decision framework — and it’s what the radar does.

The evidence: this is measured, not asserted

This isn’t an opinion — it’s one of the most replicated findings in vulnerability management:

• Governments publish it annually. The CISA/FBI/NSA joint advisory on the Top Routinely Exploited Vulnerabilities lists, every year, the most-exploited CVEs — and the list is consistently dominated by vulnerabilities one to five years old (the 2022 edition topped out with a 2018 Fortinet flaw alongside 2021’s Log4Shell and ProxyShell).
• Only a tiny fraction of CVEs are ever exploited. The research behind EPSS (FIRST.org) shows roughly 5% of vulnerabilities are exploited in the wild — and that CVSS is a poor way to find them. Ranking by exploitation probability beats “patch every critical” on both coverage and wasted effort.
• A working exploit is one of the strongest predictors. The Cyentia Institute’s Prioritization to Prediction studies (with Kenna Security and RAND) found that the existence of a public exploit raises the odds of real-world exploitation several-fold, while CVSS-based prioritisation performs close to random for which vulnerabilities actually get attacked.

One honest nuance: this doesn’t mean “old is dangerous, new is safe.” Some new CVEs are exploited within days — attacker time-to-exploit is shrinking — so recency fails as a signal in both directions. The point isn’t age at all: it’s that exploitation evidence (KEV), exploitation probability (EPSS) and exploit availability predict attacks, while CVE age and CVSS severity don’t.

What this means for how you defend — and how Nisura prices it

If ransomware breaks in through known, exposed, weaponised CVEs, then the highest-value thing you can do is find your externally-visible weaknesses and weight them by what’s actually being exploited:

• Prioritise KEV on your edge, first. Internet-facing VPNs, firewalls, file-transfer and virtualisation appliances that appear on CISA KEV are where ransomware starts. Age is irrelevant; exposure and exploitation are everything.
• Weight by EPSS and public-exploit availability, not CVSS — so the top of your remediation list is the fix that removes the most real risk.
• Translate it into euros. Nisura scans your external attack surface and prices each exposure as Expected Annual Loss, ranking remediation by the financial risk it removes — the same KEV + EPSS + affinity logic behind the radar, mapped to NIS2, GDPR and DORA liability.

So the next time our radar shows a 2022 CVE above a 2026 one, that’s the model working exactly as it should. Watch the live picture on the Ransomware CVE Radar, or run the free CRQ simulation to see your own exposure — ranked by what attackers actually exploit, priced in euros.

Sources & references

• CISA — Known Exploited Vulnerabilities (KEV) catalog and the SSVC decision framework.
• FIRST.org — EPSS (Exploit Prediction Scoring System), the model behind the exploitation-probability score (and the research showing ~5% of CVEs are ever exploited).
• CISA/FBI/NSA — Top Routinely Exploited Vulnerabilities (the annual list, consistently dominated by CVEs one to five years old), and the Cyentia Institute’s Prioritization to Prediction research on exploit availability vs. CVSS as predictors.
• Our own breakdown of the CISA vulnerability review — attackers exploit your known, exposed weaknesses, not zero-days.
• Verizon — Data Breach Investigations Report (DBIR) on the rise of edge/exposed-device exploitation as an initial-access route.

EPSS values are illustrative snapshots and change daily; specific figures are not permanent. CVE examples are drawn from the live ransomware CVE radar and are used to illustrate the ranking method, not as a fixed list.