Flaws added in January 2026
From Exploited flaws, HARD’s guide to the flaws being used in attacks
This article lists the flaws CISA added in January 2026. For the newest, see Exploited flaws.
In January 2026, CISA added 17 flaws to its list of vulnerabilities being used in attacks, 3 of them in things people have at home; 2 have been used by ransomware gangs. Most came from Microsoft (3), SmarterTools (2) and Ivanti (1).[1]
About half let an attacker take over the product, running their own code or taking full control.
List of flaws
Every flaw CISA added in January 2026, newest first, in plain English, each with an article of its own.[2] marks the ones used in ransomware.
Show
1 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2026-1281At work |
Ivanti Endpoint Manager Mobile (EPMM). Attackers can run their own code on Ivanti Endpoint Manager Mobile (EPMM) from anywhere, without logging in. | At work |
1 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2026-24858At work |
Fortinet products. Attackers can get into Fortinet products without a valid password. | At work |
5 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2026-24061At work |
GNU InetUtils. Attackers can get into GNU InetUtils without a valid password. | At work |
CVE-2026-23760† Used in ransomwareAt work |
SmarterTools SmarterMail. Attackers can get into SmarterTools SmarterMail without a valid password. | At work |
CVE-2026-21509At home |
Microsoft Office. Attackers can get past a security protection in Microsoft Office. | At home |
CVE-2025-52691† Used in ransomwareAt work |
SmarterTools SmarterMail. Attackers can run their own code on SmarterTools SmarterMail from anywhere, without logging in. | At work |
CVE-2018-14634At work |
Linux Kernel. Someone who already has a way in can corrupt memory in Linux Kernel to take more control. | At work |
1 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2024-37079At work |
Broadcom VMware vCenter Server. Attackers can run their own code on Broadcom VMware vCenter Server. | At work |
4 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2025-68645At work |
Synacor Zimbra Collaboration Suite (ZCS). Attackers can read files on Synacor Zimbra Collaboration Suite (ZCS) that should be out of reach from anywhere, without logging in. | At work |
CVE-2025-54313At work |
Prettier eslint-config-prettier. A tampered release of Prettier eslint-config-prettier was published with malicious code built in. | At work |
CVE-2025-34026At work |
Versa Concerto. Attackers can get into Versa Concerto without a valid password. | At work |
CVE-2025-31125At work |
Vitejs. Attackers can reach parts of Vitejs that should be locked to them. | At work |
1 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2026-20045At work |
Cisco Unified Communications Manager. Attackers can run their own code on Cisco Unified Communications Manager from anywhere, without logging in. | At work |
1 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2026-20805At home |
Microsoft Windows. Attackers can read information from Microsoft Windows that should be private. | At home |
1 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2025-8110At work |
Gogs. Attackers can run their own code on Gogs. | At work |
2 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2025-37164At work |
Hewlett Packard Enterprise (HPE) OneView. Attackers can run their own code on Hewlett Packard Enterprise (HPE) OneView from anywhere, without logging in. | At work |
CVE-2009-0556At home |
Microsoft Office. Attackers can run their own code on Microsoft Office. | At home |
Companies
The flaws were in 14 companies’ products; the most were in Microsoft’s (3).
| Company | Flaws | Ransomware |
|---|---|---|
| Microsoft | 3 | – |
| SmarterTools | 2 | 2 |
| Broadcom | 1 | – |
| Cisco | 1 | – |
| Fortinet | 1 | – |
| GNU | 1 | – |
| Gogs | 1 | – |
| Hewlett Packard Enterprise (HPE) | 1 | – |
| Ivanti | 1 | – |
| Linux | 1 | – |
| Prettier | 1 | – |
| Synacor | 1 | – |
| Versa | 1 | – |
| Vite | 1 | – |
Other months
Every month since CISA started the list; January 2026 is outlined.
| Year | Jan | Feb | Mar | Apr | May | Jun | Jul | Aug | Sep | Oct | Nov | Dec | Total |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2026 | 17 | 28 | 26 | 31 | 21 | 23 | 26 | 31 | 43 | 36 | 282 | ||
| 2025 | 14 | 27 | 32 | 15 | 24 | 20 | 20 | 15 | 16 | 31 | 11 | 20 | 245 |
| 2024 | 21 | 9 | 10 | 10 | 14 | 9 | 14 | 19 | 25 | 17 | 22 | 16 | 186 |
| 2023 | 5 | 14 | 18 | 17 | 19 | 24 | 16 | 8 | 19 | 18 | 18 | 11 | 187 |
| 2022 | 40 | 32 | 226 | 45 | 83 | 48 | 3 | 23 | 24 | 12 | 10 | 9 | 555 |
| 2021 | 291 | 20 | 311 |
References
- ^ Cybersecurity and Infrastructure Security Agency. “Known Exploited Vulnerabilities Catalog”. Version 2026.10.30, updated 30 Oct 2026. CISA adds a flaw when it has reliable evidence of it being used in attacks; the date is when it was added, not when the attacks began.
- ^ HARD. Plain-English summaries written from CISA’s and NVD’s text, on each flaw’s page.
See also Exploited flaws, Companies, and Search for any app or company.