The Noise in the Silence: Unmasking CISA's Hidden KEV Ransomware Updates
Summary: GreyNoise found that 59 vulnerabilities silently flipped to "known ransomware use" in CISA's KEV catalog during 2025, with no alert or announcement beyond a field change in a JSON file. Nineteen of the 59 target network security appliances, including Fortinet SSL-VPN, Ivanti Connect Secure, Palo Alto GlobalProtect and Check Point Security Gateway, and authentication bypasses and RCE flaws led the pack.
What's compelling: The devices in that list of 19 are the ones deployed to protect the organization, and the ransomware flag on them changed without anyone being told; GreyNoise's response is an hourly RSS feed at kev.labs.greynoise.io that fires whenever the flag flips.
Read the original at GreyNoise Blog ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026