CISA KEV Ransomware Status Changes
Why this dashboard exists
CISA periodically flips a CVE's
knownRansomwareCampaignUse flag in the KEV catalog
from Unknown to Known — without a public
announcement. This silent update tells defenders the CVE is
now actively exploited by ransomware crews, but only operators
who diff the KEV daily catch it.
Greynoise's blog documents how they monitor the daily diff. Their feed plus a historical CSV bootstrap drive this dashboard.
Sources: kev-ransom-feed.rss · ransomware-status-changes-2025.csv
Total flips
…
…Flips by year
Top affected vendors (top 25)
| Vendor | Flips |
|---|
Recent ransomware-status flips
Download JSON
Loading recent flips…