CISA Known Exploited Vulnerabilities
KEV additions — February 2026
27 CVEs entered the KEV catalog in February 2026.
Get an alert for each new CVE published for the software you run.
Set up CVE WatchFree account · no credit card
Added February 25, 20262
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2022-20775 | Cisco SD-WAN Path Traversal Vulnerability | 7.8 | 12.5 % | Feb 27, 2026 |
| CVE-2026-20127 | Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability | 10 | 88.5 % | Feb 27, 2026 |
Added February 24, 20261
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2026-25108 | Soliton Systems K.K FileZen OS Command Injection Vulnerability | 8.8 | 5.2 % | Mar 17, 2026 |
Added February 20, 20262
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2025-49113 | roundcubemail: Remote Code Execution in Roundcube via Unvalidated _from Parameter | 9.9 | 99.0 % | Mar 13, 2026 |
| CVE-2025-68461 | RoundCube Webmail Cross-site Scripting Vulnerability | 6.1 | 26.8 % | Mar 13, 2026 |
Added February 18, 20262
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2021-22175 | GitLab Server-Side Request Forgery (SSRF) Vulnerability | 9.8 | 53.4 % | Mar 11, 2026 |
| CVE-2026-22769 | Dell RecoverPoint for Virtual Machines (RP4VMs) Use of Hard-coded Credentials Vulnerability | 10 | 13.5 % | Feb 21, 2026 |
Added February 17, 20263
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2020-7796 | Synacor Zimbra Collaboration Suite (ZCS) Server-Side Request Forgery Vulnerability | 9.8 | 84.4 % | Mar 10, 2026 |
| CVE-2024-7694 | TeamT5 ThreatSonar Anti-Ransomware Unrestricted Upload of File with Dangerous Type Vulnerability | 7.2 | 1.8 % | Mar 10, 2026 |
| CVE-2026-2441 | Google Chromium CSS Use-After-Free Vulnerability | 8.8 | 55.0 % | Mar 10, 2026 |
Added February 13, 20261
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2026-1731 | Remote code execution vulnerability in BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) | 9.8 | 92.5 % | Feb 16, 2026 |
Added February 12, 20264
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2024-43468 | Microsoft Configuration Manager SQL Injection Vulnerability | 9.8 | 81.0 % | Mar 5, 2026 |
| CVE-2025-15556 | Notepad++ Download of Code Without Integrity Check Vulnerability | 7.5 | 1.8 % | Mar 5, 2026 |
| CVE-2025-40536 | SolarWinds Web Help Desk Security Control Bypass Vulnerability | 8.1 | 73.6 % | Feb 15, 2026 |
| CVE-2026-20700 | Memory Corruption Allows Arbitrary Code Execution on Apple Operating Systems | 7.8 | 1.4 % | Mar 5, 2026 |
Added February 10, 20266
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2026-21510 | Windows Shell Security Feature Bypass Vulnerability | 8.8 | 24.5 % | Mar 3, 2026 |
| CVE-2026-21513 | MSHTML Framework Security Feature Bypass Vulnerability | 8.8 | 15.9 % | Mar 3, 2026 |
| CVE-2026-21514 | Microsoft Word Security Feature Bypass Vulnerability | 7.8 | 1.6 % | Mar 3, 2026 |
| CVE-2026-21519 | Desktop Window Manager Elevation of Privilege Vulnerability | 7.8 | 2.5 % | Mar 3, 2026 |
| CVE-2026-21525 | Windows Remote Access Connection Manager Denial of Service Vulnerability | 6.2 | 4.8 % | Mar 3, 2026 |
| CVE-2026-21533 | Windows Remote Desktop Services Elevation of Privilege Vulnerability | 7.8 | 4.1 % | Mar 3, 2026 |
Added February 5, 20262
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2025-11953 | React Native Community CLI OS Command Injection Vulnerability | 9.8 | 94.0 % | Feb 26, 2026 |
| CVE-2026-24423ransomware | SmarterTools SmarterMail < Build 9511 Unauthenticated RCE via ConnectToHub API | 9.8 | 88.2 % | Feb 26, 2026 |
Added February 3, 20264
| CVE | Vulnerability | CVSS | EPSS | Due date |
|---|---|---|---|---|
| CVE-2019-19006 | Sangoma FreePBX Improper Authentication Vulnerability | 9.8 | 55.9 % | Feb 24, 2026 |
| CVE-2021-39935 | GitLab Community and Enterprise Editions Server-Side Request Forgery (SSRF) Vulnerability | 7.5 | 36.1 % | Feb 24, 2026 |
| CVE-2025-40551 | SolarWinds Web Help Desk Deserialization of Untrusted Data Remote Code Execution Vulnerability | 9.8 | 84.2 % | Feb 6, 2026 |
| CVE-2025-64328 | Sangoma FreePBX OS Command Injection Vulnerability | 7.2 | 84.6 % | Feb 24, 2026 |