Flaws added in February 2022

From Exploited flaws, HARD’s guide to the flaws being used in attacks

This article lists the flaws CISA added in February 2022. For the newest, see Exploited flaws.

February 2022

Flaws added each day; used in ransomware

Flaws added	32
In things at home	19
Used in ransomware	10
Companies	12
Most from	Microsoft 16Apple 3Adobe 2
Busiest day	10 Feb 2022 15
Next month	March 2022 226
Month before	January 2022 40
Source	CISA KEV, version 2026.10.30

In February 2022, CISA added 32 flaws to its list of vulnerabilities being used in attacks, 19 of them in things people have at home; 10 have been used by ransomware gangs. Most came from Microsoft (16), Apple (3) and Zabbix (2).^[1]

Almost all let an attacker take over the product, running their own code or taking full control.

List of flaws

Every flaw CISA added in February 2022, newest first, in plain English, each with an article of its own.^[2] marks the ones used in ransomware.

Friday 25 February 2022 4 added

CVE	Flaw	Found
`CVE-2022-24682`† Used in ransomwareAt work	Synacor Zimbra Collaborate Suite (ZCS). Attackers can run their own code on Synacor Zimbra Collaborate Suite (ZCS).	At work
`CVE-2017-8570`At home	Microsoft Office. Attackers can run their own code on Microsoft Office.	At home
`CVE-2017-0222`At home	Microsoft Internet Explorer. Attackers can run their own code on Microsoft Internet Explorer.	At home
`CVE-2014-6352`At home	Microsoft Windows. Attackers can run their own code on Microsoft Windows.	At home

Tuesday 22 February 2022 2 added

CVE	Flaw	Found
`CVE-2022-23134`At work	Zabbix Frontend. Attackers can reach parts of Zabbix Frontend that should be locked to them from anywhere, without logging in.	At work
`CVE-2022-23131`At work	Zabbix Frontend. Attackers can use Zabbix Frontend to take full control of the machine from anywhere, without logging in.	At work

Tuesday 15 February 2022 9 added

CVE	Flaw	Found
`CVE-2022-24086`At work	Adobe Commerce and Magento Open Source. Attackers can run their own code on Adobe Commerce and Magento Open Source.	At work
`CVE-2022-0609`At home	Chrome and other Chromium browsers. A booby-trapped web page can corrupt memory in Chrome and other Chromium browsers, which attackers use to take it over.	At home
`CVE-2019-0752`† Used in ransomwareAt home	Microsoft Internet Explorer. Attackers can run their own code on Microsoft Internet Explorer.	At home
`CVE-2018-8174`† Used in ransomwareAt home	Microsoft Windows. Attackers can run their own code on Microsoft Windows.	At home
`CVE-2018-20250`† Used in ransomwareAt home	WinRAR. Attackers can run their own code on WinRAR.	At home
`CVE-2018-15982`† Used in ransomwareAt home	Adobe Flash Player. Attackers can run their own code on Adobe Flash Player.	At home
`CVE-2017-9841`At work	PHPUnit. Attackers can run commands on PHPUnit.	At work
`CVE-2014-1761`At home	Microsoft Word. Attackers can run their own code on Microsoft Word.	At home
`CVE-2013-3906`At home	Microsoft Graphics Component. Attackers can run their own code on Microsoft Graphics Component.	At home

Friday 11 February 2022 1 added

CVE	Flaw	Found
`CVE-2022-22620`At home	Apple iOS, iPadOS, and macOS. Attackers can run their own code on Apple iOS, iPadOS, and macOS.	At home

Thursday 10 February 2022 15 added

CVE	Flaw	Found
`CVE-2021-36934`At home	Microsoft Windows. Attackers can run their own code on Microsoft Windows.	At home
`CVE-2020-0796`† Used in ransomwareAt work	Microsoft SMBv3. Attackers can run their own code on Microsoft SMBv3.	At work
`CVE-2018-1000861`At work	Jenkins Stapler Web Framework. Attackers can run their own code on Jenkins Stapler Web Framework.	At work
`CVE-2017-9791`At work	Apache Struts 1. Attackers can run their own code on Apache Struts 1.	At work
`CVE-2017-8464`At home	Microsoft Windows. Someone who already has a way in can use Microsoft Windows to run their own code.	At home
`CVE-2017-10271`† Used in ransomwareAt work	Oracle WebLogic Server. Attackers can run their own code on Oracle WebLogic Server from anywhere, without logging in.	At work
`CVE-2017-0263`At home	Microsoft Win32k. Someone who already has a foothold can use Microsoft Win32k to take full control of the machine.	At home
`CVE-2017-0262`At home	Microsoft Office. Attackers can run their own code on Microsoft Office.	At home
`CVE-2017-0145`† Used in ransomwareAt work	Microsoft SMBv1. Attackers can run their own code on Microsoft SMBv1.	At work
`CVE-2017-0144`† Used in ransomwareAt work	Microsoft SMBv1. Attackers can run their own code on Microsoft SMBv1.	At work
`CVE-2016-3088`At work	Apache ActiveMQ. Attackers are using a flaw in Apache ActiveMQ.	At work
`CVE-2015-2051`At home	D-Link DIR-645 Router. Attackers can run their own code on D-Link DIR-645 Router.	At home
`CVE-2015-1635`At work	Microsoft HTTP.sys. Attackers can run their own code on Microsoft HTTP.sys.	At work
`CVE-2015-1130`At home	Apple OS X. Attackers can get into Apple OS X without a valid password.	At home
`CVE-2014-4404`At home	Apple OS X. Attackers can run their own code on Apple OS X.	At home

Friday 4 February 2022 1 added

CVE	Flaw	Found
`CVE-2022-21882`† Used in ransomwareAt home	Microsoft Win32k. Someone who already has a foothold can use Microsoft Win32k to take full control of the machine.	At home

Companies

The flaws were in twelve companies’ products; the most were in Microsoft’s (16).

Company	Flaws	Ransomware
Microsoft	16	6
Apple	3	–
Adobe	2	1
Apache	2	–
Zabbix	2	–
D-Link	1	–
Google	1	–
Jenkins	1	–
Oracle	1	1
PHPUnit	1	–
RARLAB	1	1
Synacor	1	1

Other months

Every month since CISA started the list; February 2022 is outlined.

Flaws added to CISA’s list each month
Year	Jan	Feb	Mar	Apr	May	Jun	Jul	Aug	Sep	Oct	Nov	Dec	Total
2026	17	28	26	31	21	23	26	31	43	36			282
2025	14	27	32	15	24	20	20	15	16	31	11	20	245
2024	21	9	10	10	14	9	14	19	25	17	22	16	186
2023	5	14	18	17	19	24	16	8	19	18	18	11	187
2022	40	32	226	45	83	48	3	23	24	12	10	9	555
2021											291	20	311

2026282 flaws

Jan17 Feb28 Mar26 Apr31 May21 Jun23 Jul26 Aug31 Sep43 Oct36NovDec

2025245 flaws

Jan14 Feb27 Mar32 Apr15 May24 Jun20 Jul20 Aug15 Sep16 Oct31 Nov11 Dec20

2024186 flaws

Jan21 Feb9 Mar10 Apr10 May14 Jun9 Jul14 Aug19 Sep25 Oct17 Nov22 Dec16

2023187 flaws

Jan5 Feb14 Mar18 Apr17 May19 Jun24 Jul16 Aug8 Sep19 Oct18 Nov18 Dec11

2022555 flaws

Jan40 Feb32 Mar226 Apr45 May83 Jun48 Jul3 Aug23 Sep24 Oct12 Nov10 Dec9

2021311 flaws

JanFebMarAprMayJunJulAugSepOctNov291 Dec20

References

^ Cybersecurity and Infrastructure Security Agency. “Known Exploited Vulnerabilities Catalog”. Version 2026.10.30, updated 30 Oct 2026. CISA adds a flaw when it has reliable evidence of it being used in attacks; the date is when it was added, not when the attacks began.
^ HARD. Plain-English summaries written from CISA’s and NVD’s text, on each flaw’s page.

See also Exploited flaws, Companies, and Search for any app or company.