NewsCompaniesFlawsGuides
Get the app

Flaws added in March 2026

From Exploited flaws, HARD’s guide to the flaws being used in attacks
This article lists the flaws CISA added in March 2026. For the newest, see Exploited flaws.

In March 2026, CISA added 26 flaws to its list of vulnerabilities being used in attacks, 9 of them in things people have at home; 2 have been used by ransomware gangs. Most came from Apple (6), Google (2) and Citrix (1).[1]

Most let an attacker take over the product, running their own code or taking full control.

List of flaws

Every flaw CISA added in March 2026, newest first, in plain English, each with an article of its own.[2] marks the ones used in ransomware.

1 added

CVEFlawFound
CVE-2026-3055At work Citrix NetScaler. Attackers can corrupt memory in Citrix NetScaler, which they use to take it over. At work

1 added

CVEFlawFound
CVE-2025-53521At work F5 BIG-IP. Attackers can run their own code on F5 BIG-IP. At work

1 added

CVEFlawFound
CVE-2026-33634At work Aquasecurity Trivy. A tampered release of Aquasecurity Trivy was published with malicious code built in. At work

1 added

CVEFlawFound
CVE-2026-33017At work Langflow. Attackers can run their own code on Langflow from anywhere, without logging in. At work

5 added

CVEFlawFound
CVE-2025-54068At work Laravel Livewire. Attackers can run their own code on Laravel Livewire from anywhere, without logging in. At work
CVE-2025-43520At home Apple devices. Attackers can corrupt memory in Apple devices, which they use to take it over. At home
CVE-2025-43510At home Apple devices. Attackers can corrupt memory in Apple devices, which they use to take it over. At home
CVE-2025-32432At work Craft CMS. Attackers can run their own code on Craft CMS. At work
CVE-2025-31277At home Apple devices. Attackers can corrupt memory in Apple devices, which they use to take it over. At home

1 added

CVEFlawFound
CVE-2026-20131† Used in ransomwareAt work Cisco Secure Firewall Management Center (FMC). Attackers can run their own code on Cisco Secure Firewall Management Center (FMC) from anywhere, without logging in. At work

2 added

CVEFlawFound
CVE-2026-20963At work Microsoft SharePoint. Attackers can run their own code on Microsoft SharePoint. At work
CVE-2025-66376At work Synacor Zimbra Collaboration Suite (ZCS). Attackers can run code in the browser of someone using Synacor Zimbra Collaboration Suite (ZCS) and act as them. At work

1 added

CVEFlawFound
CVE-2025-47813At work Wing FTP Server. Attackers can read information from Wing FTP Server that should be private. At work

2 added

CVEFlawFound
CVE-2026-3910At home Chrome and other Chromium browsers. A booby-trapped web page can run an attacker's code through Chrome and other Chromium browsers. At home
CVE-2026-3909At work Google Skia. A booby-trapped web page can corrupt memory in Google Skia, which attackers use to take it over. At work

1 added

CVEFlawFound
CVE-2025-68613At work n8n. Someone who already has a way in can use n8n to run their own code. At work

3 added

CVEFlawFound
CVE-2026-1603At work Ivanti Endpoint Manager (EPM). Attackers can get into Ivanti Endpoint Manager (EPM) without a valid password. At work
CVE-2025-26399† Used in ransomwareAt work SolarWinds Web Help Desk. Attackers can run their own code on SolarWinds Web Help Desk from anywhere, without logging in. At work
CVE-2021-22054At work Omnissa Workspace One UEM. Attackers can make Omnissa Workspace One UEM send requests into the network behind it from anywhere, without logging in. At work

5 added

CVEFlawFound
CVE-2023-43000At home Apple devices. Attackers can corrupt memory in Apple devices, which they use to take it over. At home
CVE-2023-41974At home Apple iOS and iPadOS. Attackers can run their own code on Apple iOS and iPadOS. At home
CVE-2021-30952At home Apple devices. Attackers can run their own code on Apple devices. At home
CVE-2021-22681At work Rockwell products. Attackers are using a flaw in Rockwell products. At work
CVE-2017-7921At home Hikvision products. Someone who already has a foothold can use Hikvision products to take full control of the machine. At home

2 added

CVEFlawFound
CVE-2026-22719At work Broadcom VMware Aria Operations. Attackers can run their own code on Broadcom VMware Aria Operations from anywhere, without logging in. At work
CVE-2026-21385At home Qualcomm Multiple Chipsets. Attackers can corrupt memory in Qualcomm Multiple Chipsets, which they use to take it over. At home

Companies

The flaws were in 20 companies’ products; the most were in Apple’s (6).

CompanyFlawsRansomware
Apple6–
Google2–
Aquasecurity1–
Broadcom1–
Cisco11
Citrix1–
Craft CMS1–
F51–
Hikvision1–
Ivanti1–
Langflow1–
Laravel1–
Microsoft1–
n8n1–
Omnissa1–
5 others5

Other months

Every month since CISA started the list; March 2026 is outlined.

Flaws added to CISA’s list each month
YearJanFebMarAprMayJunJulAugSepOctNovDecTotal
2026 17282631212326314336 282
2025 142732152420201516311120 245
2024 2191010149141925172216 186
2023 5141817192416819181811 187
2022 40322264583483232412109 555
2021 29120 311
2026282 flaws
Jan17Feb28Mar26Apr31May21Jun23Jul26Aug31Sep43Oct36NovDec
2025245 flaws
Jan14Feb27Mar32Apr15May24Jun20Jul20Aug15Sep16Oct31Nov11Dec20
2024186 flaws
Jan21Feb9Mar10Apr10May14Jun9Jul14Aug19Sep25Oct17Nov22Dec16
2023187 flaws
Jan5Feb14Mar18Apr17May19Jun24Jul16Aug8Sep19Oct18Nov18Dec11
2022555 flaws
Jan40Feb32Mar226Apr45May83Jun48Jul3Aug23Sep24Oct12Nov10Dec9
2021311 flaws
JanFebMarAprMayJunJulAugSepOctNov291Dec20

References

  1. ^ Cybersecurity and Infrastructure Security Agency. “Known Exploited Vulnerabilities Catalog”. Version 2026.10.30, updated 30 Oct 2026. CISA adds a flaw when it has reliable evidence of it being used in attacks; the date is when it was added, not when the attacks began.
  2. ^ HARD. Plain-English summaries written from CISA’s and NVD’s text, on each flaw’s page.

See also Exploited flaws, Companies, and Search for any app or company.