Wednesday, February 11, 2026 Archive

Archived Security Snapshot

Critical vulnerabilities, curated daily for security professionals

Archived Security Brief

Yesterday's disclosures revealed critical vulnerabilities across SAP, Microsoft, Apache, and WordPress ecosystems, with two CVSS 9.9 flaws affecting SAP CRM and the Catalyst Game Server Platform. The day's 109 total CVEs include 9 critical-severity issues (down 40% from the prior day) and 100 high-priority vulnerabilities (up 23%). Notable critical entries include CVE-2026-0488 in SAP CRM, CVE-2026-26009 in Catalyst Game Server Platform, and CVE-2026-23906 in Apache Druid, all scoring 9.8 or above. Attack patterns center on remote code execution and authentication bypass across enterprise platforms, with 21 vulnerabilities confirmed as actively exploited in the wild, including long-standing flaws in Zimbra Collaboration Suite, VMware vCenter Server, and multiple SmarterMail instances. No patches have been confirmed available at this time, making compensating controls and network segmentation essential for affected systems.

  • Two CVSS 9.9 vulnerabilities disclosed in SAP CRM (CVE-2026-0488) and Catalyst Game Server Platform (CVE-2026-26009)
  • 9 critical-severity CVEs, down 40% from the prior day's 15 critical disclosures
  • 100 high-priority CVEs (CVSS 7.0-8.9), up 23% from 81 the prior day
  • Remote code execution and authentication bypass patterns across WordPress, Apache Druid, Azure SDK, and Agentflow
  • 0% confirmed patch availability across all 109 disclosed vulnerabilities
  • 21 actively exploited vulnerabilities including legacy flaws in FreePBX, Linux kernel, and GitLab dating back to 2018-2021

Immediate action: Prioritize review of SAP CRM, SAP NetWeaver, Microsoft Office, and Microsoft Windows deployments, as these vendors have both critical-severity and actively exploited vulnerabilities in yesterday's disclosures. With no confirmed patches currently available, implement network segmentation, restrict access to affected services, and monitor for indicators of compromise while awaiting vendor advisories.

How to read this brief

CVSS score (e.g. 9.1) — severity from 0–10. Red marks critical (9+), orange high (7–8.9).

Exploitability — how hard the flaw is to attack, read from the CVSS vector:

  • Network / Adjacent / Local / Physical — how close an attacker must get. Network means reachable over the internet.
  • No / Low / High privileges — the access they need first. No privileges means no login required.
  • No interaction / User interaction — whether a victim has to do something (open a file, click a link). No interaction means fully automatable.

The lower the bar on all three, the easier to exploit at scale — “Network · No privileges · No interaction” is the worst case: hit from anywhere, no credentials, no victim action.

Actively exploited — confirmed under attack in the wild (CISA’s Known Exploited Vulnerabilities catalog). Prioritize these regardless of score.

EPSS · Nth percentile — FIRST.org’s estimated chance a flaw is exploited within 30 days. We flag it only in the top 10% — a statistical signal it’s unusually likely to be targeted, separate from whether attacks are confirmed.

💡 Tip: Swipe CVE cards left to ⭐ star, right to ❌ remove

Section Navigation