Monday, February 23, 2026

Today's Security Snapshot

Critical vulnerabilities, curated daily for security professionals

đŸŽ¯ SSCV Profile

See how vulnerabilities affect your specific environment

CRS uses the System Security Context Vector (SSCV) Framework v1.0 to adjust CVSS scores based on your system's exposure level, network position, and business criticality. Learn more about SSCV Framework

Risk scores will be adjusted based on your selected environment

Today's Security Brief

Monday's vulnerability disclosures reveal significant exposure across Microsoft Windows and Office products, with multiple actively exploited flaws targeting core enterprise infrastructure. The brief includes 1 critical vulnerability (down 50% from prior day) and 63 high-priority CVEs (down 37%), reflecting a quieter but still consequential disclosure cycle. CVE-2026-24494 (CVSS 9.8) affects the Online Ordering System, while five Microsoft Windows CVEs and one Office CVE are confirmed under active exploitation. Notably, legacy vulnerabilities in GitLab, Zimbra, Roundcube Webmail, and Sangoma FreePBX continue to see exploitation activity, underscoring persistent risk from unpatched older systems. Patch availability stands at 0%, making compensating controls and network-level mitigations essential until vendor fixes are released.

  • Microsoft Windows and Office account for 6 actively exploited vulnerabilities across remote code execution and privilege escalation vectors
  • 1 critical CVE disclosed (CVSS 9.8), down 50% from the prior day's 2 critical vulnerabilities
  • 63 high-priority CVEs (CVSS 7.0-8.9), a 37% decrease from the prior day's 100 high-priority disclosures
  • Active exploitation spans Roundcube Webmail, GitLab, Sangoma FreePBX, Google Chromium, and Apple OS — covering email, DevOps, VoIP, and browser attack surfaces
  • Patch availability is at 0% — no vendor fixes are currently available for disclosed vulnerabilities
  • 21 CVEs have confirmed active exploitation, consistent with the prior day's count

Immediate action: Prioritize reviewing exposure to Microsoft Windows, Office, Roundcube Webmail, and GitLab environments, as these face confirmed active exploitation with no patches currently available. Implement network segmentation, access restrictions, and enhanced monitoring for affected systems as compensating controls until vendor patches are released.

💡 Tip: Swipe CVE cards left to ⭐ star, right to ❌ remove

Section Navigation