The 2022 State of the Threat Report from Secureworks identified software vulnerabilities as the primary initial access vector for ransomware.
https://www.securitymagazine.com/articles/98454-vulnerability-exploitation-is-top-initial-access-vector-for-ransomware