#StopRansomware: Medusa Ransomware
cisa.gov · Undated · Licence: not cleared; local research copy only
CVEs this report names
4 CVEs- CVE-2026-1731BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) OS Command Injection VulnerabilityBeyondTrust · Remote Support (RS) and Privileged Remote Access (PRA)KEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter2 reports93.1%Top 0.17%91.0priority
- CVE-2024-1709ConnectWise ScreenConnect Authentication Bypass VulnerabilityConnectWise · ScreenConnectKEVRansomwarePublic exploitCritical · 10.0T1190Exploit Public-Facing ApplicationT1078Valid Accounts1 report>99.9%Top 0.02%83.9priority
- CVE-2023-48788Fortinet FortiClient EMS SQL Injection VulnerabilityFortinet · FortiClient EMSKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter+1 more · 1 report98.4%Top 0.08%83.7priority
- CVE-2025-10035Fortra GoAnywhere MFT Deserialization of Untrusted Data VulnerabilityFortra · GoAnywhere MFTKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter1 report99.8%Top 0.04%83.7priority
Where it names them
CVE-2026-1731 Original (opens in a new tab) ↗ Original (opens in a new tab) ↗ Original (opens in a new tab) ↗
18, 2026) BeyondTrust vulnerability CVE-2026-1731 [CWE-78: OS Command Injection].
18, 2026) BeyondTrust vulnerability CVE-2026-1731 [CWE-78: OS Command Injection].
Medusa actors leverage vulnerability announcements, such as the February 2026 publication of BeyondTrust vulnerability CVE-2026-1731, to identify CVEs to exploit.
CVE-2024-1709 Original (opens in a new tab) ↗ Original (opens in a new tab) ↗
ScreenConnect vulnerability CVE-2024-1709 [CWE-288: Authentication Bypass Using an Alternate Path or Channel].
ScreenConnect vulnerability CVE-2024-1709 [CWE-288: Authentication Bypass Using an Alternate Path or Channel].
CVE-2023-48788 Original (opens in a new tab) ↗ Original (opens in a new tab) ↗
Fortinet EMS SQL injection vulnerability CVE-2023-48788 [CWE 89: SQL Injection].
Fortinet EMS SQL injection vulnerability CVE-2023-48788 [CWE 89: SQL Injection].
CVE-2025-10035 Original (opens in a new tab) ↗ Original (opens in a new tab) ↗
18, 2026) Fortra GoAnywhere vulnerability CVE-2025-10035 [CWE-502: Deserialization of Untrusted Data].
18, 2026) Fortra GoAnywhere vulnerability CVE-2025-10035 [CWE-502: Deserialization of Untrusted Data].
Techniques drawn from this report
1 link, in kill-chain orderInitial Access Exploit Public-Facing Application T1190 for CVE-2024-1709
AI mapping from the description
Exploitation of unpatched software vulnerabilities [T1190] through Common Vulnerabilities and Exposures (CVEs) such as: ScreenConnect vulnerability CVE-2024-1709 [CWE-288: Authentication Bypass Using an Alternate Path or Channel].