Sunday, February 22, 2026

Today's Security Snapshot

Critical vulnerabilities, curated daily for security professionals

🎯 SSCV Profile

See how vulnerabilities affect your specific environment

CRS uses the System Security Context Vector (SSCV) Framework v1.0 to adjust CVSS scores based on your system's exposure level, network position, and business criticality. Learn more about SSCV Framework

Risk scores will be adjusted based on your selected environment

Today's Security Brief

Sunday's vulnerability disclosures center on actively exploited flaws across Microsoft Windows, Microsoft Office, Apple OS, and Roundcube Webmail, alongside critical-severity issues in Redis OneUptime and SAML SSO implementations. Only 2 critical CVEs were disclosed, down 86% from the prior day's 14, while 100 high-priority vulnerabilities held steady. CVE-2026-27574 (CVSS 9.9) affects Redis OneUptime and CVE-2026-27197 (CVSS 9.1) targets SAML-based single sign-on in Sentry, both presenting significant remote exploitation risk. The 21 actively exploited vulnerabilities span a wide range of products including multiple Microsoft Windows components, Google Chromium, GitLab, Sangoma FreePBX, and Roundcube Webmail, indicating broad targeting across enterprise infrastructure. No patches are currently available for the disclosed CVEs, requiring defenders to prioritize compensating controls and monitoring.

  • CVE-2026-27574 (CVSS 9.9) in Redis OneUptime represents the highest-severity disclosure, with potential for remote code execution
  • Critical CVE count dropped sharply to 2, down 86% from 14 the prior day
  • High-priority CVEs remain steady at 100, unchanged from the previous day
  • Authentication bypass and remote code execution patterns dominate, affecting SAML SSO (Sentry), Microsoft Windows, Apple OS, and Google Chromium
  • Patch availability stands at 0% — no vendor fixes are currently released for Sunday's disclosed vulnerabilities
  • 21 vulnerabilities have confirmed active exploitation, spanning Microsoft, GitLab, Roundcube Webmail, Sangoma FreePBX, and Notepad++

Immediate action: Prioritize monitoring and compensating controls for Microsoft Windows (CVE-2026-21513, CVE-2026-21525, CVE-2026-21510, CVE-2026-21533, CVE-2026-21519), Microsoft Office (CVE-2026-21514), Apple OS (CVE-2026-20700), Roundcube Webmail (CVE-2025-49113, CVE-2025-68461), and Google Chromium (CVE-2026-2441), all of which are under active exploitation. With 0% patch availability, implement network segmentation, restrict access to affected services, and increase endpoint detection sensitivity until vendor patches are released.

💡 Tip: Swipe CVE cards left to ⭐ star, right to ❌ remove

Section Navigation