Monday, February 2, 2026 Archive

Archived Security Snapshot

Critical vulnerabilities, curated daily for security professionals

Archived Security Brief

Yesterday's disclosures included 5 critical-severity CVEs (CVSS 9.0+), a notable increase from the prior day's zero critical vulnerabilities. High-priority CVEs numbered 24, representing a 43% decrease from the previous day's 42. Twelve actively exploited vulnerabilities were added to the KEV catalog, affecting Microsoft Windows (CVE-2026-20805), Cisco Unified Communications Manager (CVE-2026-20045), VMware vCenter Server (CVE-2024-37079), and Microsoft Office (CVE-2026-21509). Critical vulnerabilities include CVE-2026-25202 affecting database credentials in multiple products and CVE-2024-2356 involving local file inclusion. Patch availability currently stands at 0%, requiring organizations to implement compensating controls until vendor fixes are released.

  • 5 critical CVEs disclosed (CVSS 9.0+), up from 0 the prior day
  • 24 high-priority CVEs (CVSS 7.0-8.9), down 43% from 42
  • 12 actively exploited vulnerabilities affecting Microsoft, Cisco, VMware, and Zimbra
  • 0% patch availability across disclosed vulnerabilities
  • Affected systems include Windows, vCenter Server, Unified Communications Manager, and SmarterMail

Immediate action: Prioritize review of Microsoft Windows, Cisco Unified Communications Manager, and VMware vCenter Server environments given active exploitation. With no patches currently available, implement network segmentation and enhanced monitoring for affected systems until vendor remediation is released.

How to read this brief

CVSS score (e.g. 9.1) — severity from 0–10. Red marks critical (9+), orange high (7–8.9).

Exploitability — how hard the flaw is to attack, read from the CVSS vector:

  • Network / Adjacent / Local / Physical — how close an attacker must get. Network means reachable over the internet.
  • No / Low / High privileges — the access they need first. No privileges means no login required.
  • No interaction / User interaction — whether a victim has to do something (open a file, click a link). No interaction means fully automatable.

The lower the bar on all three, the easier to exploit at scale — “Network · No privileges · No interaction” is the worst case: hit from anywhere, no credentials, no victim action.

Actively exploited — confirmed under attack in the wild (CISA’s Known Exploited Vulnerabilities catalog). Prioritize these regardless of score.

EPSS · Nth percentile — FIRST.org’s estimated chance a flaw is exploited within 30 days. We flag it only in the top 10% — a statistical signal it’s unusually likely to be targeted, separate from whether attacks are confirmed.

💡 Tip: Swipe CVE cards left to ⭐ star, right to ❌ remove

Section Navigation