#StopRansomware: SafePay Ransomware

What's on the official record

CISA published cybersecurity advisory AA26-293A, "#StopRansomware: SafePay Ransomware," on 20 October 2026. The advisory details recent activity by the SafePay ransomware group. CISA reports that SafePay actors have been highly active since August 2024, targeting businesses and critical infrastructure across North America, South America, Europe, and Australia. CISA states that SafePay actors typically gain access to networks through known vulnerabilities, and the advisory names five CVEs: CVE-2020-3259, CVE-2023-20269, CVE-2023-27532, CVE-2024-40711, and CVE-2024-40766.

Assessment

For a platform or AI-stack owner, the record names five CVEs that CISA attributes to SafePay actors' typical access path. The advisory lets you check whether any of CVE-2020-3259, CVE-2023-20269, CVE-2023-27532, CVE-2024-40711, or CVE-2024-40766 is present in your environment and patch or isolate the affected version before it is used for initial access.

For a cyber underwriter, the record identifies a ransomware group active since August 2024 against businesses and critical infrastructure across four continents. The advisory lets you price or condition coverage by asking whether an insured has remediated the five named CVEs, and whether its exposure sits in the sectors and regions CISA names.

What would change this call

A CISA update naming additional CVEs, a specific victim, or a change in SafePay's access methods would change what a platform owner patches and what an underwriter conditions on.

What to check next

Confidence

Filed 25 October 2026 from the record dated 20 October 2026.

Sources

[1] #StopRansomware: SafePay Ransomware — https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-293a