CISA Makes Unpublicized Ransomware Updates to KEV Catalog

GreyNoise found that CISA's Known Exploited Vulnerabilities (KEV) catalog had 59 CVEs in 2025 whose "Known To Be Used in Ransomware Campaigns?" flag was quietly flipped from "Unknown" to "Known"—in some cases days after catalog inclusion and in others months or years later. Many flipped CVEs are high-severity remote code execution or authentication-bypass flaws affecting vendors like Microsoft, Ivanti, Fortinet and expose edge devices; the silent updates impede timely prioritization, so GreyNoise published an RSS feed to notify defenders of ransomware-flag changes.