Flaws added in February 2026
From Exploited flaws, HARD’s guide to the flaws being used in attacks
This article lists the flaws CISA added in February 2026. For the newest, see Exploited flaws.
In February 2026, CISA added 28 flaws to its list of vulnerabilities being used in attacks, 9 of them in things people have at home; 2 have been used by ransomware gangs. Most came from Microsoft (8), Cisco (2) and Roundcube (2).[1]
Most let an attacker take over the product, running their own code or taking full control.
List of flaws
Every flaw CISA added in February 2026, newest first, in plain English, each with an article of its own.[2] marks the ones used in ransomware.
Show
2 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2026-20127At work |
Cisco Catalyst SD-WAN Controller and Manager. Attackers can get into Cisco Catalyst SD-WAN Controller and Manager without a valid password. | At work |
CVE-2022-20775At work |
Cisco SD-WAN. Someone who already has a way in can use Cisco SD-WAN to run their own code. | At work |
1 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2026-25108At work |
Soliton Systems K.K FileZen. Attackers can run commands on Soliton Systems K.K FileZen. | At work |
2 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2025-68461At work |
Roundcube Webmail. Attackers can run code in the browser of someone using Roundcube Webmail and act as them. | At work |
CVE-2025-49113At work |
Roundcube Webmail. Someone who already has a way in can use Roundcube Webmail to run their own code. | At work |
2 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2026-22769At work |
Dell RecoverPoint for Virtual Machines (RP4VMs). Attackers can get into Dell RecoverPoint for Virtual Machines (RP4VMs) without a valid password. | At work |
CVE-2021-22175At work |
GitLab. Attackers can make GitLab send requests into the network behind it from anywhere, without logging in. | At work |
4 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2026-2441At home |
Chrome and other Chromium browsers. A booby-trapped web page can run an attacker's code through Chrome and other Chromium browsers. | At home |
CVE-2024-7694At work |
TeamT5 ThreatSonar Anti-Ransomware. Opening a booby-trapped file can let an attacker run their own code through TeamT5 ThreatSonar Anti-Ransomware. | At work |
CVE-2020-7796At work |
Synacor Zimbra Collaboration Suite. Attackers can make Synacor Zimbra Collaboration Suite send requests into the network behind it. | At work |
CVE-2008-0015At home |
Microsoft Windows. A booby-trapped web page can run an attacker's code through Microsoft Windows. | At home |
1 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2026-1731† Used in ransomwareAt work |
BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA). Attackers can run their own code on BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) from anywhere, without logging in. | At work |
4 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2026-20700At home |
Apple devices. Attackers can run their own code on Apple devices. | At home |
CVE-2025-40536At work |
SolarWinds Web Help Desk. Attackers can get past a security protection in SolarWinds Web Help Desk. | At work |
CVE-2025-15556At work |
Notepad++. Attackers can run their own code on Notepad++. | At work |
CVE-2024-43468At work |
Microsoft Configuration Manager. Attackers can run their own code on Microsoft Configuration Manager from anywhere, without logging in. | At work |
6 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2026-21533At home |
Microsoft Windows. Someone who already has a foothold can use Microsoft Windows to take full control of the machine. | At home |
CVE-2026-21525At home |
Microsoft Windows. Attackers can corrupt memory in Microsoft Windows, which they use to take it over. | At home |
CVE-2026-21519At home |
Microsoft Windows. Someone who already has a foothold can use Microsoft Windows to take full control of the machine. | At home |
CVE-2026-21514At home |
Microsoft Office. Someone who already has a foothold can use Microsoft Office to take full control of the machine. | At home |
CVE-2026-21513At home |
Microsoft Windows. Attackers can get past a security protection in Microsoft Windows. | At home |
CVE-2026-21510At home |
Microsoft Windows. Attackers can get past a security protection in Microsoft Windows. | At home |
2 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2026-24423† Used in ransomwareAt work |
SmarterTools SmarterMail. Attackers can run their own code on SmarterTools SmarterMail from anywhere, without logging in. | At work |
CVE-2025-11953At work |
React Native Community CLI. Attackers can run commands on React Native Community CLI from anywhere, without logging in. | At work |
4 added
| CVE | Flaw | Found |
|---|---|---|
CVE-2025-64328At work |
Sangoma FreePBX. Attackers can run commands on Sangoma FreePBX. | At work |
CVE-2025-40551At work |
SolarWinds Web Help Desk. Attackers can run their own code on SolarWinds Web Help Desk from anywhere, without logging in. | At work |
CVE-2021-39935At work |
GitLab Community and Enterprise Editions. Attackers can make GitLab Community and Enterprise Editions send requests into the network behind it. | At work |
CVE-2019-19006At work |
Sangoma FreePBX. Attackers can get into Sangoma FreePBX without a valid password. | At work |
Companies
The flaws were in 16 companies’ products; the most were in Microsoft’s (8).
| Company | Flaws | Ransomware |
|---|---|---|
| Microsoft | 8 | – |
| Cisco | 2 | – |
| GitLab | 2 | – |
| Roundcube | 2 | – |
| Sangoma | 2 | – |
| SolarWinds | 2 | – |
| Apple | 1 | – |
| BeyondTrust | 1 | 1 |
| Dell | 1 | – |
| 1 | – | |
| Notepad++ | 1 | – |
| React Native Community | 1 | – |
| SmarterTools | 1 | 1 |
| Soliton Systems K.K | 1 | – |
| Synacor | 1 | – |
| 1 others | 1 |
Other months
Every month since CISA started the list; February 2026 is outlined.
| Year | Jan | Feb | Mar | Apr | May | Jun | Jul | Aug | Sep | Oct | Nov | Dec | Total |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2026 | 17 | 28 | 26 | 31 | 21 | 23 | 26 | 31 | 43 | 36 | 282 | ||
| 2025 | 14 | 27 | 32 | 15 | 24 | 20 | 20 | 15 | 16 | 31 | 11 | 20 | 245 |
| 2024 | 21 | 9 | 10 | 10 | 14 | 9 | 14 | 19 | 25 | 17 | 22 | 16 | 186 |
| 2023 | 5 | 14 | 18 | 17 | 19 | 24 | 16 | 8 | 19 | 18 | 18 | 11 | 187 |
| 2022 | 40 | 32 | 226 | 45 | 83 | 48 | 3 | 23 | 24 | 12 | 10 | 9 | 555 |
| 2021 | 291 | 20 | 311 |
References
- ^ Cybersecurity and Infrastructure Security Agency. “Known Exploited Vulnerabilities Catalog”. Version 2026.10.30, updated 30 Oct 2026. CISA adds a flaw when it has reliable evidence of it being used in attacks; the date is when it was added, not when the attacks began.
- ^ HARD. Plain-English summaries written from CISA’s and NVD’s text, on each flaw’s page.
See also Exploited flaws, Companies, and Search for any app or company.