CISA KEV · February 2026
In February 2026, CISA added 28 vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, up from 17 in January 2026. 2 entries are known to be used in ransomware campaigns. The most affected vendors were Microsoft (8), Cisco (2), Roundcube (2). Every entry below has reliable evidence of exploitation in the wild, so if you run the product, patch or mitigate it first.
| Added | CVE | Vulnerability | Federal due |
|---|---|---|---|
| 25 Feb 2026 | CVE-2026-20127 | Cisco Catalyst SD-WAN Controller and Manager Authentication Bypass VulnerabilityCisco · Catalyst SD-WAN Controller and Manager | |
| 25 Feb 2026 | CVE-2022-20775 | Cisco SD-WAN Path Traversal VulnerabilityCisco · SD-WAN | |
| 24 Feb 2026 | CVE-2026-25108 | Soliton Systems K.K FileZen OS Command Injection VulnerabilitySoliton Systems K.K · FileZen | |
| 20 Feb 2026 | CVE-2025-68461 | RoundCube Webmail Cross-site Scripting VulnerabilityRoundcube · Webmail | |
| 20 Feb 2026 | CVE-2025-49113 | RoundCube Webmail Deserialization of Untrusted Data VulnerabilityRoundcube · Webmail | |
| 18 Feb 2026 | CVE-2026-22769 | Dell RecoverPoint for Virtual Machines (RP4VMs) Use of Hard-coded Credentials VulnerabilityDell · RecoverPoint for Virtual Machines (RP4VMs) | |
| 18 Feb 2026 | CVE-2021-22175 | GitLab Server-Side Request Forgery (SSRF) VulnerabilityGitLab · GitLab | |
| 17 Feb 2026 | CVE-2026-2441 | Google Chromium CSS Use-After-Free VulnerabilityGoogle · Chromium | |
| 17 Feb 2026 | CVE-2024-7694 | TeamT5 ThreatSonar Anti-Ransomware Unrestricted Upload of File with Dangerous Type VulnerabilityTeamT5 · ThreatSonar Anti-Ransomware | |
| 17 Feb 2026 | CVE-2020-7796 | Synacor Zimbra Collaboration Suite (ZCS) Server-Side Request Forgery VulnerabilitySynacor · Zimbra Collaboration Suite | |
| 17 Feb 2026 | CVE-2008-0015 | Microsoft Windows Video ActiveX Control Remote Code Execution VulnerabilityMicrosoft · Windows | |
| 13 Feb 2026 | CVE-2026-1731 | BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) OS Command Injection VulnerabilityRANSOMWAREBeyondTrust · Remote Support (RS) and Privileged Remote Access (PRA) | |
| 12 Feb 2026 | CVE-2026-20700 | Apple Multiple Buffer Overflow VulnerabilityApple · Multiple Products | |
| 12 Feb 2026 | CVE-2025-40536 | SolarWinds Web Help Desk Security Control Bypass VulnerabilitySolarWinds · Web Help Desk | |
| 12 Feb 2026 | CVE-2025-15556 | Notepad++ Download of Code Without Integrity Check VulnerabilityNotepad++ · Notepad++ | |
| 12 Feb 2026 | CVE-2024-43468 | Microsoft Configuration Manager SQL Injection VulnerabilityMicrosoft · Configuration Manager | |
| 10 Feb 2026 | CVE-2026-21533 | Microsoft Windows Improper Privilege Management VulnerabilityMicrosoft · Windows | |
| 10 Feb 2026 | CVE-2026-21525 | Microsoft Windows NULL Pointer Dereference VulnerabilityMicrosoft · Windows | |
| 10 Feb 2026 | CVE-2026-21519 | Microsoft Windows Type Confusion VulnerabilityMicrosoft · Windows | |
| 10 Feb 2026 | CVE-2026-21514 | Microsoft Office Word Reliance on Untrusted Inputs in a Security Decision VulnerabilityMicrosoft · Office | |
| 10 Feb 2026 | CVE-2026-21513 | Microsoft MSHTML Framework Protection Mechanism Failure VulnerabilityMicrosoft · Windows | |
| 10 Feb 2026 | CVE-2026-21510 | Microsoft Windows Shell Protection Mechanism Failure VulnerabilityMicrosoft · Windows | |
| 5 Feb 2026 | CVE-2026-24423 | SmarterTools SmarterMail Missing Authentication for Critical Function VulnerabilityRANSOMWARESmarterTools · SmarterMail | |
| 5 Feb 2026 | CVE-2025-11953 | React Native Community CLI OS Command Injection VulnerabilityReact Native Community · CLI | |
| 3 Feb 2026 | CVE-2025-64328 | Sangoma FreePBX OS Command Injection VulnerabilitySangoma · FreePBX | |
| 3 Feb 2026 | CVE-2025-40551 | SolarWinds Web Help Desk Deserialization of Untrusted Data VulnerabilitySolarWinds · Web Help Desk | |
| 3 Feb 2026 | CVE-2021-39935 | GitLab Community and Enterprise Editions Server-Side Request Forgery (SSRF) VulnerabilityGitLab · Community and Enterprise Editions | |
| 3 Feb 2026 | CVE-2019-19006 | Sangoma FreePBX Improper Authentication VulnerabilitySangoma · FreePBX |
Run your vendors and products through stack check, pre-filled with this month's vendors; it also gives you an RSS feed for new additions. The long-run picture is on CVE Trends.
28 vulnerabilities. In January 2026 it added 17.
Microsoft, with 8 entries. Next were Cisco (2), Roundcube (2), GitLab (2).
It is the US Cybersecurity and Infrastructure Security Agency's list of vulnerabilities with reliable evidence of exploitation in the wild, currently 1,767 entries. US federal agencies must fix listed vulnerabilities by the due date; for everyone else it is the best public list of what to patch first.
How this is made: generated automatically from the CISA KEV catalog, grouped by the date CISA added each entry. Vulnerability names are CISA's. Federal due dates apply to US agencies under BOD 22-01; for everyone else they are a sensible upper bound.
We wire CISA KEV and EPSS into your scanner, SIEM and ticketing, so your team sees the few entries that match your estate, with deadlines an auditor accepts.
Get in touch →