Executive Summary

Ransomware does not need a vulnerability that directly deploys ransomware.

 

The vulnerabilities associated with ransomware activity during H1 2026 frequently provide something more fundamental: access, authentication, privilege, code execution or control over systems positioned close to the enterprise's critical infrastructure.

 

Hackerstorm analysed 20 ransomware-linked vulnerabilities added or identified during H1 2026.

 

The dataset shows:

 

■  Median CVSS: 9.3 (range: 7.2–10.0)

■ 12 of 20 vulnerabilities (60%) scored CVSS 9.0 or higher

■ Median EPSS: 81.0% (range: 1.8%–100%)

■ 13 of 20 (65%) had EPSS of 50% or higher

■ 6 of 20 had EPSS above 90%

■ 18 of 20 (90%) had High confidentiality impact

■ 16 of 20 (80%) had High integrity impact

■ 16 of 20 (80%) had High availability impact

■ 16 of 20 (80%) were High/High/High across confidentiality, integrity and availability

■ 8 of 20 (40%) combined a high CVSS score with a high EPSS score — the remaining 60% show meaningful divergence between severity and exploitation probability

■ 7 of 20 (35%) trace back to just three vendors (Microsoft, SimpleHelp, SmarterTools)

■ 6 of 20 (30%) were exploited as zero-days — actively attacked before the vendor published a patch or advisory, in windows ranging from roughly a week to more than two months

 

The data also reveals a recurring presence of VPNs, firewalls, remote-support platforms, management systems and other infrastructure that can sit between the public internet and the internal enterprise.

 

This matters because the operational consequence of exploiting a vulnerability depends on more than its severity score.

 

The important question is:

 

Where does the vulnerable system sit, what does it control, and how far can an attacker move from it?

 

 

1. The H1 Ransomware Vulnerability Landscape

 

The H1 dataset contains 20 vulnerabilities linked to ransomware activity. The vulnerabilities span enterprise applications, remote-access systems, network infrastructure, management platforms, security products and software supply-chain components. The severity profile is notable.

 

■ The median CVSS score is 9.3, with 60% of the vulnerabilities scoring 9.0 or higher.

■ Scores range from 7.2 (SimpleHelp, CVE-2024-57728) to a maximum of 10.0 (Cisco Secure Firewall Management Center, CVE-2026-20131)  meaning even the "lowest" vulnerability in the set would still be classified High severity under CVSS.

 

However, severity alone does not describe exploitation likelihood.

 

■ The median EPSS score is 81.0%, and 65% of the vulnerabilities had an EPSS score of at least 50%.

■ EPSS scores range from 1.8% (Nx Console) to 100% (JetBrains TeamCity).

 

Six vulnerabilities had EPSS above 90%.

 

This produces a dataset in which ransomware-linked vulnerabilities are not simply theoretically severe. Many also have a high modelled probability of exploitation.

 

But the data also contains important divergence. For example:

 

• ■ CVE-2026-0257 - CVSS 7.8 / EPSS 95.2%
• ■ CVE-2024-27199 - CVSS 7.3 / EPSS 100%
• ■ CVE-2026-41940 - CVSS 9.3 / EPSS 98.5%
• ■ CVE-2026-48027 - CVSS 9.3 / EPSS 1.8%
• ■ CVE-2026-45321 - CVSS 9.6 / EPSS 2.3%

 

The implication for vulnerability management is straightforward:

 

Severity describes potential impact. Exploitation likelihood describes probability. Network position determines how exploitation can translate into organisational exposure.

 

 

 

2. What Kind of Vulnerabilities Are Associated With Ransomware?

 

Looking across the H1 dataset reveals a pattern that is less visible when vulnerabilities are considered individually.

 

The weaknesses are concentrated around three capabilities that matter directly to ransomware operations:

 

obtaining access, executing code and commands, and gaining the ability to modify or disrupt systems and data.

 

The CWE, technical-impact and business-impact profiles below provide three different views of the same 20 vulnerabilities.

 

 

2.1 Common Weakness Enumeration (CWE - MITRE) Profile

 

The most frequently represented weakness in the H1 dataset is Deserialization of Untrusted Data, appearing in 4 of the 20 vulnerabilities.

 

Path traversal and missing authentication for critical function each appear in 3 vulnerabilities.

 

Embedded malicious code, improper authentication and link-resolution weaknesses each appear in 2.

 

 

Chart: CWE Profile of H1 2026 Ransomware-Linked Vulnerabilities

 

CWE distribution

 

Percentages use the 20 H1 vulnerabilities as the denominator.
Some vulnerabilities contain more than one CWE, so category percentages are not mutually exclusive and therefore do not total 100%.

 

The pattern is important because several of these weakness classes can provide an attacker with a progression from initial access to control.

 

Deserialization flaws can enable code execution. Authentication weaknesses can remove barriers to entry. Path traversal can expose or modify files. Authorization weaknesses can allow an attacker to obtain privileges beyond those originally granted.

 

The CWE profile therefore provides another way of viewing the dataset: not simply how severe the vulnerabilities are, but what types of control failures repeatedly appear in ransomware-linked vulnerabilities.

 

 

2.2 Business Impact Profile

 

The business-impact data shows an even stronger concentration.

 

■ Confidentiality is High in 18 of the 20 vulnerabilities (90%).

■ Integrity is High in 16 vulnerabilities (80%), while;

■ Availability is High in 16 (80%).

 

Overall, 16 of the 20 vulnerabilities have High impact across all three CIA dimensions.

 

Business impact

 

This matters because ransomware operations increasingly involve more than encryption.

 

A vulnerability that permits access to sensitive information, administrative control or trusted business systems can support multiple stages of an operation.

 

The H1 data therefore shows a vulnerability landscape with substantial potential consequences for:

 

■ sensitive information

■ business data

■ system integrity

■ administrative control

■ service availability

 

The vulnerability itself may not encrypt files.

 

Its value to an attacker can instead be the control it provides over systems that hold or manage those files.

 

 

2.3 Technical Impact Profile

 

The technical-impact data provides perhaps the clearest connection between the vulnerabilities and the mechanics of a ransomware intrusion.

 

Across the 20 vulnerabilities:

 

■ 60% can execute unauthorised code or commands

■ 55% can modify data, files or memory

■ 50% can read data, files or memory

■ 45% can provide privilege or identity takeover

■ 40% include a denial-of-service or disruption capability

■ 5% explicitly include credential or token theft

 

 

Technical impact

 

Technical Impact Profile of H1 2026 Ransomware-Linked Vulnerabilities

 

These categories overlap.  A vulnerability may simultaneously allow an attacker to read files, modify them and execute commands. The percentages therefore represent the proportion of the 20 vulnerabilities associated with each capability rather than mutually exclusive categories.

 

The significance is that a large proportion of the dataset provides capabilities that map directly onto the stages of a ransomware operation.

 

The attacker does not necessarily need a vulnerability that says "deploy ransomware." They need a vulnerability that provides sufficient control to begin operating inside the environment.

 

 

3. The Network Edge and Identity as a Ransomware Attack Surface

 

The H1 dataset contains a recurring presence of vulnerabilities affecting systems positioned at the network edge, remote-access layer or privileged management plane.

 

Examples include:

 

■ Check Point VPN

■ Palo Alto Networks GlobalProtect

■ Cisco Secure Firewall Management Center

■ ConnectWise ScreenConnect

■ SimpleHelp

■ BeyondTrust Remote Support/PRA

■ cPanel/WHM

■ other management and control-plane technologies

 

The dataset should not be interpreted as showing that every ransomware-linked vulnerability affects an edge device. The stronger observation is that edge, remote-access and privileged management systems recur throughout the dataset.

 

That distinction matters.

 

A significant proportion of the ransomware-linked vulnerabilities examined affect systems positioned at the network edge or within privileged management planes. These systems can be particularly valuable to attackers because compromise may provide an externally reachable path into the wider organisation, together with access to identity, configuration or other network resources.

 

This is consistent with wider reporting during 2026 highlighting the security importance of internet-facing edge infrastructure.

 

3.1 Vendor and product concentration

 

Vendor repetition is also worth noting. Three vendors account for over a third of the dataset: Microsoft appears three times (Windows Tasks, Exchange Server, Defender), while SimpleHelp and SmarterTools/SmarterMail each appear twice. Together these three vendors represent 7 of the 20 vulnerabilities (35%); the remaining 13 vulnerabilities are single appearances spread across 13 distinct vendors. This suggests ransomware-linked exposure in H1 was not concentrated in a single product but was somewhat concentrated in a small number of platforms that appear repeatedly as either remote-support/administration tooling (SimpleHelp) or widely deployed enterprise software (Microsoft).

 

The operational question is therefore changing from:

 

Which CVEs are critical? to Which vulnerable systems provide an attacker with a useful position inside the enterprise?

 

 

3.2 From Edge Device to Enterprise Control

 

A vulnerable edge or remote-access system can form part of an attack path that looks very different from a conventional endpoint compromise.

 

 

 

Attack path

 

The vulnerability is only the first step. The operational significance comes from what the attacker can obtain after exploitation. An attacker compromising a VPN, firewall management system or remote-support platform may obtain a position from which they can affect many systems. This creates a broader concept of blast radius.

 

The relevant calculation is not simply:  CVSS = 9.8

 

It is closer to: CVSS + Reachability + Privilege + Network Position + Asset Criticality

 

 

3.3 Identity as a Force Multiplier

 

The H1 dataset also shows that identity cannot be separated cleanly from vulnerability risk. The vulnerabilities include:

 

■ authentication bypass

■ missing authentication

■ improper authentication

■ missing authorization

■ privilege escalation

■ session or cookie-validation weaknesses

 

This becomes particularly significant when identity weaknesses occur on remotely accessible infrastructure.

 

The combination is:

 

Edge infrastructure: provides network position.

 

Identity weakness : provides authority.

 

Together:

Network position + identity privilege = potential enterprise control

 

This is why a vulnerability with a moderate CVSS score can still require urgent attention when it affects an internet-facing authentication boundary.

 

CVE-2026-0257 illustrates the issue. Its CVSS score is 7.8, but its EPSS score is 95.2%, and the vulnerability permits an attacker to establish an unauthorised VPN connection.

 

The numerical severity does not disappear and neither does the operational significance of the access mechanism.

 

 

3.4 The Visibility Gap at the Perimeter

 

Traditional security architectures often place considerable defensive emphasis on endpoints and servers.

 

Yet network infrastructure can sit outside or between those heavily monitored environments.

 

This creates an important visibility problem. An attacker operating through compromised edge infrastructure may not behave like an attacker operating directly from a conventional workstation.

 

The defensive response therefore needs to extend beyond endpoint telemetry. Organisations should consider:

 

■ edge-device logging

■ configuration monitoring

■ authentication events

■ administrative activity

■ network telemetry

■ outbound connections

■ centralised log retention

■ forensic procedures for network appliances

■ monitoring for unexpected configuration changes

 

The question is not simply whether the edge device is patched.

 

It is whether the organisation can see what happens if that device is compromised.

 

 

3.5 Unsupported Infrastructure as Persistent Risk

 

Vulnerability management generally assumes that identifying a vulnerability leads to remediation.

 

That assumption becomes weaker when the affected device is obsolete or unsupported. The sequence becomes:

 

Vulnerability → no supported patch → persistent exposure → internet accessibility → potential network pivot

 

This turns vulnerability management into an asset-lifecycle problem as well as a patch-management problem.

 

An organisation may know that an internet-facing device has a vulnerability but still be unable to remediate it through a normal vendor-supported update process.

 

For edge infrastructure, therefore, asset inventory needs to include:

 

■ vendor support status

■ firmware/software lifecycle

■ internet exposure

■ management interfaces

■ authentication dependencies

■ network reach

■ replacement options

 

The existence of a vulnerability is only one part of the exposure.

 

 

4. CVSS Does Not Tell the Whole Story

 

The H1 dataset demonstrates why severity and exploitation probability need to be considered separately.

 

High CVSS / low EPSS

 

CVE-2026-48027

■ CVSS: 9.3

■ EPSS: 1.8%

 

CVE-2026-45321

■ CVSS: 9.6

■ EPSS: 2.3%

 

 

Moderate-high CVSS / extremely high EPSS

CVE-2024-27199

■ CVSS: 7.3

■ EPSS: 100%

 

 

CVE-2026-0257

■ CVSS: 7.8

■ EPSS: 95.2%

 

This divergence is not limited to a handful of illustrative outliers — it runs through the dataset as a whole. Splitting the 20 vulnerabilities into a simple quadrant (CVSS ≥9.0 as "high severity", EPSS ≥50% as "high exploitation probability") shows:

 

CVSS / EPSS quadrant

 

 

Only 40% of the dataset falls into the "high severity, high exploitation probability" quadrant that a CVSS-only or EPSS-only view might assume is typical. A quarter of the dataset (25%) combines a moderate CVSS score with a high EPSS score — vulnerabilities that a CVSS-only triage queue could plausibly deprioritise despite a high real-world likelihood of exploitation.

 

This demonstrates why a CVSS-only workflow can produce an incomplete view of operational exposure.

 

A vulnerability's practical priority depends on multiple dimensions:

 

■ Severity

■ Exploitation likelihood

■ Observed exploitation

■ Internet reachability

■ Privilege

■ Network position

■ Asset criticality

■ Business impact

 

The objective is not to replace CVSS. It is to place CVSS within a broader vulnerability-intelligence context.

 

 

5. Exploitation Timelines: Zero-Day, Fast N-Day and Dormant Patterns

 

CVSS and EPSS describe a vulnerability's characteristics at a point in time. They do not show when, relative to disclosure, attackers actually started using it. Reconstructing that timeline from vendor advisories, CISA KEV records and independent threat-intelligence reporting for each of the 20 H1 vulnerabilities reveals a pattern that severity and probability scores alone do not surface: exploitation timing clusters by weakness type and system category, not by CVSS score.

 

Three distinct patterns emerge.

 

5.1 True Zero-Days: Exploited Before Disclosure

 

Six of the 20 vulnerabilities (30%) were confirmed to have been actively exploited before the vendor published a patch or advisory — meaning defenders had no CVE, no patch and no official guidance for some or all of the exploitation window.

 

 

Every zero-day in the dataset is either a missing/improper-authentication flaw (CWE-306, CWE-287) or a command-execution/deserialization flaw (CWE-78, CWE-502) on an internet-facing VPN, control-panel or firewall-management interface. None is a supply-chain or local-privilege-escalation case. This sharpens the report's edge-infrastructure finding considerably: edge and management-plane systems in this dataset are not just present — they are the category attackers find and weaponize before vendors know to patch.

 

5.2 Fast N-Day Exploitation: Disclosure to Attack in Hours or Days

 

A second, larger cluster follows the more conventional pattern, a patch or advisory is published and exploitation begins once technical detail or proof-of-concept code becomes available, typically within days.

 

5.3 Supply-Chain Compromises: No Patch Gap to Measure

 

CVE-2026-48027 (Nx Console) and CVE-2026-45321 (TanStack) do not fit a disclosure-to-exploitation model at all. In both cases the malicious package was the exploit from the moment it was published — Nx Console 18.95.0 was live on the Visual Studio Marketplace and OpenVSX for 18–36 minutes, and 84 malicious versions across 42 TanStack packages were published over roughly six minutes. There is no legitimate pre-compromise window to measure; these belong in their own category rather than being scored on a timeline built for patch gaps.

 

5.4 The Dormant Tail: Patched Years Earlier, Weaponized Much Later

 

A third pattern — and a genuinely new angle on the age finding in Section 7 — is vulnerabilities that were patched long before H1 2026 and only confirmed as actively exploited (added to CISA KEV) much later, with no clear single trigger event visible in public reporting.

 

 

None of these three have a publicly reported exact first-exploitation date — only the date CISA confirmed active exploitation, which by definition lags true first use by an unknown margin. That is itself an operationally relevant finding: KEV-driven prioritisation alone will miss this entire category until an external trigger (research disclosure, incident response finding, or CISA's own enrichment process) surfaces it, sometimes years after the patch existed.

 

5.5 What This Means for Prioritisation

 

The weakness class predicts the exploitation timeline more reliably than the CVSS score does:

 

■ Authentication and command-execution flaws on internet-facing management interfaces cluster toward zero-day exploitation. For this category, waiting for a KEV listing before acting means acting after the fact in every case observed here.

■ RCE and deserialization flaws with public technical detail cluster toward fast N-day exploitation, typically inside two weeks. For this category, the priority is patching speed in the days immediately following disclosure.

■ Everything else — particularly local-privilege-escalation and older internal-facing software — has a long, unpredictable tail that KEV-only monitoring will not catch until something external forces re-examination.

 

This is a distinction CVSS and EPSS alone do not provide, and it argues for weighting remediation urgency by system category and weakness class in addition to the standard scoring inputs.

 

Note on source precision: dates in this section are drawn from vendor advisories, CISA KEV records and independent threat-intelligence reporting (Check Point, BeyondTrust, Oracle/Mandiant, Rapid7, Arctic Wolf, watchTowr, Cloud Security Alliance, and others cited in Sources). Precision varies, some dates carry hour-level detail from vendor telemetry, others are the date CISA confirmed exploitation rather than a true first-use date. Where a vendor revised its own timeline after initial disclosure (BeyondTrust, Oracle), the revised figure is used. The zero-day/weakness-class correlation in 16.5 is a pattern observed across 20 cases, not a statistically validated result, and should be described as indicative rather than proven when published.

 

 

6. Ransomware Does Not Need a Ransomware-Specific Vulnerability

 

The vulnerabilities analysed generally do not perform ransomware encryption themselves, instead, they provide capabilities that an attacker can use during an intrusion:

 

Vulnerability → Control → Identity / Privilege → Lateral Movement → Data Access / Exfiltration → Ransomware / Extortion

 

 

7. The Age of a Vulnerability Does Not Remove Its Ransomware Relevance

 

The H1 dataset also demonstrates that ransomware-linked vulnerabilities are not restricted to newly disclosed vulnerabilities.

 

The dataset contains vulnerabilities originally disclosed years before H1 2026, including:

 

■ CVE-2023-27351 — PaperCut NG

■ CVE-2023-21529 — Microsoft Exchange Server

■ CVE-2024-1708 — ConnectWise ScreenConnect

■ CVE-2024-27199 — JetBrains TeamCity

■ CVE-2024-57726 — SimpleHelp

■ CVE-2024-57728 — SimpleHelp

■ CVE-2025-60710 — Microsoft Windows Tasks

 

Using each CVE identifier's assigned year as an approximate proxy for original disclosure date, 8 of the 20 H1 vulnerabilities (40%) carry a pre-2026 CVE identifier — meaning they were originally disclosed in 2023, 2024 or 2025, in some cases (PaperCut NG, Microsoft Exchange Server) more than two years before appearing in this H1 2026 dataset. (Note: the CVE-ID year is a reasonable but imperfect proxy for true disclosure date, since some CVEs are reserved before public disclosure; treat this as indicative rather than exact.)

 

This creates an important vulnerability-management observation.

 

The relevant question is not:

 

When was the CVE published?

 

It is:

 

Is the vulnerable asset still present, reachable and exploitable?

 

A vulnerability can remain operationally relevant long after its disclosure date.

 

 

8. What the Vulnerability Characteristics Tell Us

 

Taken together, the CWE, technical-impact and business-impact profiles reveal three connected layers.

 

Layer 1  Weakness

 

The underlying failures repeatedly involve:

■ deserialization

■ authentication

■ authorization

■ path handling

■ code execution

■ malicious code

■ access control

 

Layer 2  Technical capability

 

Those weaknesses can provide:

■ code execution

■ data access

■ modification capability

■ privilege

■ disruption

 

Layer 3  Business consequence

 

Those technical capabilities frequently translate into:

■ information exposure

■ loss of data integrity

■ service disruption

■ administrative compromise

■ broader enterprise impact

 

This creates a more useful vulnerability-intelligence model than treating each CVE as an isolated score.

 

 

9. What Ransomware Vulnerability Management Should Measure

 

The H1 findings support a broader prioritisation model.

 

Discover

 

Identify:

■ internet-facing assets

■ VPNs

■ firewalls

■ remote-support platforms

■ management interfaces

■ externally accessible applications

■ end-of-support infrastructure

 

Prioritise

 

Combine:

■ CVSS

■ EPSS

■ KEV status

■ observed exploitation

■ network reachability

■ privilege

■ asset criticality

■ business impact

 

Harden

 

Focus on:

■ MFA

■ authentication controls

■ management interfaces

■ segmentation

■ least privilege

■ secure configuration

■ lifecycle management

 

Monitor

Increase visibility around:

■ administrative activity

■ authentication

■ configuration changes

■ unexpected outbound connections

■ network behaviour

■ exploitation indicators

 

Prepare

Maintain incident-response procedures for:

■ compromised edge appliances

■ VPN compromise

■ remote-support compromise

■ management-plane compromise

■ identity takeover

■ lateral movement

 

 

10. What Changed in H1 2026?

 

The H1 dataset does not establish that ransomware has completely shifted away from traditional targets.

 

It does, however, show a recurring presence of vulnerabilities affecting infrastructure that can connect, authenticate or control the enterprise.

 

That is an important distinction.

 

The emerging pattern is less about a specific product category and more about the value of the access position created by exploitation.

 

A vulnerability in an externally accessible control plane can have a fundamentally different operational consequence from the same theoretical severity affecting an isolated system.

 

This is why vulnerability intelligence needs to incorporate network position and privilege alongside severity.

 

 

11. Analysis and Conclusion: The Shift to "Blast Radius"

 

The most important finding from the H1 dataset is not that ransomware-linked vulnerabilities have high CVSS scores. That is expected. The more useful finding is that many of these vulnerabilities provide disproportionate operational control.

 

The technical and business impact profile shows this clearly:

 

■ 60% enable unauthorised code or command execution.

■ 55% provide modification capability.

■ 50% provide data, file, or memory read capability.

■ 45% provide privilege or identity takeover.

■ 90% show High confidentiality impact, and 80% show High integrity and High availability impact.

 

These flaws also often affect infrastructure that sits directly between the public internet and the enterprise — VPNs, firewalls, control panels and remote-support platforms — which is why the same technical capability can carry a very different real-world consequence depending on where the vulnerable system sits.

 

Traditional metrics have distinct limits here. CVSS describes the characteristics of the vulnerability. EPSS estimates exploitation probability. KEV confirms known exploitation. None of those measurements, on its own, describes the complete organisational consequence of compromising a particular asset. That is why this report supports a broader model:

 

Vulnerability risk = severity + exploitation likelihood + reachability + privilege + network position + asset criticality.

 

The precise weighting will differ between organisations; the principle matters more than a universal formula. Instead of asking only "how severe is this vulnerability?", vulnerability-management teams should also ask what position exploitation gives the attacker, and what the attacker can reach from that position. This is the concept of vulnerability blast radius.

 

The H1 dataset reinforces that this is not a hypothetical concern. 40% of the 20 vulnerabilities carried a pre-2026 CVE identifier, and 35% of the dataset traced back to just three vendors — a reminder that ransomware-linked exposure is driven as much by what remains unpatched and internet-facing as by what is newly disclosed. The exploitation-timeline evidence in Section 5 makes the same point from a different angle: 30% of the dataset was exploited as a zero-day, before any patch existed to apply.

 

For defenders, the practical conclusion is that patching faster is not, on its own, a complete strategy. A vulnerability on an internet-facing VPN, firewall management system or remote-support platform represents a fundamentally different exposure from the same severity score on an isolated internal asset, and understanding that difference — what the vulnerable system represents inside the enterprise, not just how it scores — is what the H1 data ultimately argues for.

 

The vulnerability-intelligence question this report is built around is therefore not "which vulnerabilities are critical?" but which vulnerabilities give attackers the access, authority and network position needed to become operationally dangerous.

 

 

 

 

 

Further Reading

Our latest vulnerability intelligence articles and deep dives.

 

 

 

Related Analysis

Ensure you understand the latest KEV intelligence to cover off any potential gaps in your remediation activities. 

 

 

 

Frequently Asked Questions (FAQs)

 

1. Does a high CVSS score mean a vulnerability is being actively exploited by ransomware groups?
Not reliably. In this dataset, only 40% of the 20 vulnerabilities combined a high CVSS score (≥9.0) with a high EPSS exploitation-probability score (≥50%). Several vulnerabilities with near-maximum CVSS scores had EPSS scores under 3%, while others with moderate CVSS scores (7.3–7.8) had EPSS scores of 95–100%. CVSS measures potential severity, not the likelihood or timing of exploitation.

 

2. What types of systems were most commonly affected by ransomware-linked vulnerabilities in H1 2026?
Internet-facing edge, remote-access and privileged management infrastructure — VPNs, firewall management consoles, remote-support platforms and control panels — recurred throughout the dataset. These systems matter disproportionately because compromising them can provide an externally reachable path into the wider organisation, not just access to a single application.

 

3. How many of these vulnerabilities were exploited before a patch was even available?
Six of the 20 (30%) were confirmed zero-days — actively exploited before the vendor published a patch or advisory, in windows ranging from roughly a week to more than two months. Notably, every zero-day in the set involved an authentication or command-execution weakness on an internet-facing management interface, not a supply-chain or local-privilege issue.

 

4. Are older, already-patched vulnerabilities still a ransomware risk?
Yes. 40% of the vulnerabilities in the dataset carried a pre-2026 CVE identifier, and three cases were confirmed as actively exploited months to years after their original patch date — including one Microsoft Exchange Server flaw patched in February 2023 but not confirmed under active exploitation until April 2026, roughly 3.2 years later. An unpatched or still-reachable legacy system remains exploitable regardless of the CVE's age.

 

5. Does ransomware require a vulnerability specifically designed to deploy ransomware?
No. None of the vulnerabilities in the dataset perform ransomware encryption directly. Instead, they provide access, authentication bypass, privilege escalation, code execution, or file read/write capability — the building blocks an attacker uses during an intrusion, with ransomware deployment following as a later stage once sufficient control has been established.

 

 

Subscribe to get our intelligence articles as soon as we publish!

 

 

---

About This Report

 

Attribution Note

This analysis is based on publicly available reporting and security research summaries. Some technical details may change as additional information becomes available. 

 

Author Information

Timur Mehmet | Founder & Lead Editor

Timur is a veteran Information Security professional with a career spanning over three decades. Since the 1990s, he has led security initiatives across high-stakes sectors, including Finance, Telecommunications, Media, and Energy. Professional qualifications over the years have included CISSP, ISO27000 Auditor, ITIL and technologies such as Networking, Operating Systems, PKI, Firewalls. For more information including independent citations and credentials, visit our About page.

Contact: This email address is being protected from spambots. You need JavaScript enabled to view it.

 

Editorial Standards

This article adheres to Hackerstorm.com's commitment to accuracy, independence, and transparency:

• Fact-Checking: All statistics and claims are verified against primary sources and authoritative reports
• Source Transparency: Original research sources and citations are provided in the References section below
• No Conflicts of Interest: This analysis is independent and not sponsored by any vendor or organization
• Corrections Policy: We correct errors promptly and transparently. Report inaccuracies to This email address is being protected from spambots. You need JavaScript enabled to view it.

Editorial Policy: Ethics, Non-Bias, Fact Checking and Corrections

Learn More: About Hackerstorm.com | FAQs

 

 

Methodology and Scope

This analysis is based on 20 ransomware-linked vulnerabilities identified for H1 2026.

The dataset supplied for analysis contains 25 records in total. Five records were dated July or August 2026 and were therefore excluded from the H1 analysis: CVE-2026-59310 (18 Aug 2026), CVE-2026-20316 (29 Jul 2026), CVE-2026-15410 (14 Jul 2026), CVE-2026-15409 (14 Jul 2026) and CVE-2026-45659 (2 Jul 2026).

Source: [Confirm and state the primary source here — e.g., the CISA Known Exploited Vulnerabilities (KEV) catalog, filtered to entries flagged "Known Ransomware Campaign Use: Yes," supplemented with vendor advisories and threat-intelligence reporting for CWE/technical-impact classification. The draft data did not specify this explicitly; it should be named before publication given Hackerstorm's own no-uncited-statistics standard.]

The H1 dataset includes CVE identifiers, affected products, dates, CVSS scores, EPSS scores, CWE classifications, technical impacts and business impacts.

Percentages are calculated against the 20 H1 vulnerabilities unless otherwise stated.

CWE categories are not mutually exclusive because some CVEs contain multiple CWE classifications.

Technical-impact categories are also not mutually exclusive because a single vulnerability may provide multiple capabilities.

Business-impact percentages represent the CIA impact classifications recorded in the supplied dataset.

The analysis does not claim that every vulnerability in the dataset is an edge-device vulnerability, nor that ransomware activity has universally shifted to edge infrastructure. The finding is that edge, remote-access and privileged management systems occur repeatedly within the H1 ransomware-linked vulnerability set.

EPSS is treated as an exploitation-probability indicator and not as a measure of business impact. EPSS figures are reported to one decimal place throughout for consistency.

CVSS is treated as a severity measure and not as a standalone measure of operational ransomware risk.

The vulnerability-age statistic in Section 7 uses each CVE identifier's assigned year as an approximate proxy for original disclosure date; this is indicative rather than a precise disclosure-date analysis and should be validated against original advisory dates before publication if the figure is used as a headline statistic.

Several source dates in the supplied dataset are marked with an asterisk. The meaning of this marker was not defined in the source data (it may distinguish disclosure date from KEV-addition date, or reflect another internal convention) — confirm the intended meaning with the data owner before publication, and either add a defining footnote or remove the marker for the published version.

The dataset represents the ransomware-linked vulnerabilities included in the supplied analysis and should not be interpreted as a complete census of every vulnerability used by every ransomware operation during H1 2026.

The exploitation-timeline analysis in Section 5 was compiled separately from the core 20-vulnerability dataset, drawing on vendor advisories, CISA KEV catalog entries and independent threat-intelligence reporting for each CVE. Dates in that section vary in precision: some are drawn from vendor telemetry with hour-level detail, others are the date CISA confirmed exploitation, which is a lagging indicator rather than a true first-use date. Two vendors (BeyondTrust and Oracle/Mandiant) revised their own exploitation timelines after initial disclosure; the revised, more complete figures are used. This section should be treated as directionally reliable rather than authoritative to the day, and individual dates should be re-verified against the cited primary sources before publication.

 

 

Source Transparency

 

■ CISA CISA Known Exploited Vulnerabilities (KEV) catalog — catalog entries and dates-added for all 20 H1 CVEs and the exploitation-timeline analysis in Section 5.

■ Vendor advisories Oracle Security Alert (CVE-2026-35273); Check Point security advisory and hotfix bulletin SK185033 (CVE-2026-50751); Palo Alto Networks PAN-OS security advisory (CVE-2026-0257); cPanel/WebPros security bulletin (CVE-2026-41940); ConnectWise ScreenConnect advisory (CVE-2024-1708/1709); SimpleHelp security advisory (CVE-2024-57726/27/28); JetBrains TeamCity advisory (CVE-2024-27199); PaperCut security bulletin (CVE-2023-27350/27351); Microsoft Security Response Center advisories (CVE-2026-33825, CVE-2025-60710, CVE-2023-21529); Cisco security advisory (CVE-2026-20131); SolarWinds security advisories (CVE-2025-26399); BeyondTrust security advisory BT26-02 (CVE-2026-1731); SmarterTools security bulletins (CVE-2026-23760, CVE-2026-24423); GitHub Security Advisories for Nx Console (GHSA-c9j4-9m59-847w) and TanStack (GHSA-g7cv-rxg3-hmpx).

■ Threat intelligence and independent research Google Threat Intelligence/Mandiant (Oracle PeopleSoft exploitation); Check Point Research and Rapid7 (Check Point VPN, Palo Alto GlobalProtect); Arctic Wolf (Palo Alto GlobalProtect, BeyondTrust); watchTowr Labs (cPanel/WHM, SolarWinds, SmarterMail); Rapid7 and BleepingComputer (cPanel/WHM); Sophos and CISA advisory AA25-163A (SimpleHelp/DragonForce); Huntress (Microsoft Defender/BlueHammer); ReliaQuest (SmarterMail/Warlock); AWS Threat Intelligence and Cloud Security Alliance AI Safety Initiative (Cisco FMC/Interlock); Microsoft Threat Intelligence (PaperCut/Clop, LockBit); Shadowserver Foundation and GreyNoise (JetBrains TeamCity, BeyondTrust scanning telemetry).

■ News coverage SecurityWeek, BleepingComputer, The Hacker News, Help Net Security, SecurityAffairs, SC Media/SC World, Dark Reading, CyberInsider, Infosecurity Magazine — reporting on disclosure and exploitation timelines cross-referenced against primary vendor and CISA sources above.

(General contextual sources on ransomware trends, edge-device exploitation and vulnerability-management frameworks — e.g. broader CISA/NCSC/FBI advisories and industry threat-landscape reports — should be added here before publication if cited elsewhere in the narrative sections.)