CISA Known Exploited Vulnerabilities

KEV additions — February 2026

27 CVEs entered the KEV catalog in February 2026.

Added February 25, 20262

CVE	Vulnerability	CVSS	EPSS	Due date
CVE-2022-20775	Cisco SD-WAN Path Traversal Vulnerability	7.8	0.2 %	February 27, 2026
CVE-2026-20127	Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability	10	54.8 %	February 27, 2026

Added February 24, 20261

CVE	Vulnerability	CVSS	EPSS	Due date
CVE-2026-25108	Soliton Systems K.K FileZen OS Command Injection Vulnerability	8.8	8.4 %	March 17, 2026

Added February 20, 20262

CVE	Vulnerability	CVSS	EPSS	Due date
CVE-2025-49113	roundcubemail: Remote Code Execution in Roundcube via Unvalidated _from Parameter	9.9	90.4 %	March 13, 2026
CVE-2025-68461	RoundCube Webmail Cross-site Scripting Vulnerability	6.1	6.9 %	March 13, 2026

Added February 18, 20262

CVE	Vulnerability	CVSS	EPSS	Due date
CVE-2021-22175	GitLab Server-Side Request Forgery (SSRF) Vulnerability	9.8	75.7 %	March 11, 2026
CVE-2026-22769	Dell RecoverPoint for Virtual Machines (RP4VMs) Use of Hard-coded Credentials Vulnerability	10	22.0 %	February 21, 2026

Added February 17, 20263

CVE	Vulnerability	CVSS	EPSS	Due date
CVE-2020-7796	Synacor Zimbra Collaboration Suite (ZCS) Server-Side Request Forgery Vulnerability	9.8	93.4 %	March 10, 2026
CVE-2024-7694	TeamT5 ThreatSonar Anti-Ransomware Unrestricted Upload of File with Dangerous Type Vulnerability	7.2	1.6 %	March 10, 2026
CVE-2026-2441	Google Chromium CSS Use-After-Free Vulnerability	8.8	9.5 %	March 10, 2026

Added February 13, 20261

CVE	Vulnerability	CVSS	EPSS	Due date
CVE-2026-1731	Remote code execution vulnerability in BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA)	9.8	81.5 %	February 16, 2026

Added February 12, 20264

CVE	Vulnerability	CVSS	EPSS	Due date
CVE-2024-43468	Microsoft Configuration Manager SQL Injection Vulnerability	9.8	84.6 %	March 5, 2026
CVE-2025-15556	Notepad++ Download of Code Without Integrity Check Vulnerability	7.5	6.1 %	March 5, 2026
CVE-2025-40536	SolarWinds Web Help Desk Security Control Bypass Vulnerability	8.1	68.9 %	February 15, 2026
CVE-2026-20700	Memory Corruption Allows Arbitrary Code Execution on Apple Operating Systems	7.8	0.4 %	March 5, 2026

Added February 10, 20266

CVE	Vulnerability	CVSS	EPSS	Due date
CVE-2026-21510	Windows Shell Security Feature Bypass Vulnerability	8.8	4.0 %	March 3, 2026
CVE-2026-21513	MSHTML Framework Security Feature Bypass Vulnerability	8.8	28.1 %	March 3, 2026
CVE-2026-21514	Microsoft Word Security Feature Bypass Vulnerability	7.8	5.4 %	March 3, 2026
CVE-2026-21519	Desktop Window Manager Elevation of Privilege Vulnerability	7.8	4.5 %	March 3, 2026
CVE-2026-21525	Windows Remote Access Connection Manager Denial of Service Vulnerability	6.2	9.4 %	March 3, 2026
CVE-2026-21533	Windows Remote Desktop Services Elevation of Privilege Vulnerability	7.8	20.2 %	March 3, 2026

Added February 5, 20262

CVE	Vulnerability	CVSS	EPSS	Due date
CVE-2025-11953	React Native Community CLI OS Command Injection Vulnerability	9.8	8.4 %	February 26, 2026
CVE-2026-24423ransomware	SmarterTools SmarterMail < Build 9511 Unauthenticated RCE via ConnectToHub API	9.8	82.0 %	February 26, 2026

Added February 3, 20264

CVE	Vulnerability	CVSS	EPSS	Due date
CVE-2019-19006	Sangoma FreePBX Improper Authentication Vulnerability	9.8	26.9 %	February 24, 2026
CVE-2021-39935	GitLab Community and Enterprise Editions Server-Side Request Forgery (SSRF) Vulnerability	7.5	54.3 %	February 24, 2026
CVE-2025-40551	SolarWinds Web Help Desk Deserialization of Untrusted Data Remote Code Execution Vulnerability	9.8	86.7 %	February 6, 2026
CVE-2025-64328	Sangoma FreePBX OS Command Injection Vulnerability	7.2	17.4 %	February 24, 2026

← All recent KEV additions