CISA maintains a catalog of vulnerabilities confirmed to have been exploited in the wild, including those confirmed used in ransomware campaigns. This page takes that set and asks a different question of it: not which vulnerability was used, but what an exploit of that class has to do on a host in order to succeed.
Tracking vulnerabilities individually produces a list that grows faster than anyone can remediate it. Tracking what exploits have to do produces a much shorter list, because the number of distinct actions is small even when the number of vulnerabilities is not. An exploit generally has to write something, load something, modify something, or elevate something. Those categories are stable even as the CVE list is not.
If the required actions are a short and stable list, they can be constrained directly. Known-good enforcement evaluates each attempted change against a verified baseline of the system's authorized state and blocks anything outside it at the kernel, before it executes. That decision does not require knowing which CVE is being exploited, whether a proof of concept has been published, or whether a vendor fix exists.
It is worth being precise about the limit. Enforcement constrains what an exploit can do on a protected host. It does not remove the vulnerability, and it is not a substitute for patching where patching is available.
Related reading: The Patch Window, The Server Threat Library, and Mimic Virtual Patching.
Records are drawn from the CISA Known Exploited Vulnerabilities catalog and its ransomware-campaign flag. The live view below is updated as CISA publishes.
