Sunday, February 22, 2026 Archive

Archived Security Snapshot

Critical vulnerabilities, curated daily for security professionals

Archived Security Brief

Sunday's vulnerability disclosures center on actively exploited flaws across Microsoft Windows, Microsoft Office, Apple OS, and Roundcube Webmail, alongside critical-severity issues in Redis OneUptime and SAML SSO implementations. Only 2 critical CVEs were disclosed, down 86% from the prior day's 14, while 100 high-priority vulnerabilities held steady. CVE-2026-27574 (CVSS 9.9) affects Redis OneUptime and CVE-2026-27197 (CVSS 9.1) targets SAML-based single sign-on in Sentry, both presenting significant remote exploitation risk. The 21 actively exploited vulnerabilities span a wide range of products including multiple Microsoft Windows components, Google Chromium, GitLab, Sangoma FreePBX, and Roundcube Webmail, indicating broad targeting across enterprise infrastructure. No patches are currently available for the disclosed CVEs, requiring defenders to prioritize compensating controls and monitoring.

  • CVE-2026-27574 (CVSS 9.9) in Redis OneUptime represents the highest-severity disclosure, with potential for remote code execution
  • Critical CVE count dropped sharply to 2, down 86% from 14 the prior day
  • High-priority CVEs remain steady at 100, unchanged from the previous day
  • Authentication bypass and remote code execution patterns dominate, affecting SAML SSO (Sentry), Microsoft Windows, Apple OS, and Google Chromium
  • Patch availability stands at 0% — no vendor fixes are currently released for Sunday's disclosed vulnerabilities
  • 21 vulnerabilities have confirmed active exploitation, spanning Microsoft, GitLab, Roundcube Webmail, Sangoma FreePBX, and Notepad++

Immediate action: Prioritize monitoring and compensating controls for Microsoft Windows (CVE-2026-21513, CVE-2026-21525, CVE-2026-21510, CVE-2026-21533, CVE-2026-21519), Microsoft Office (CVE-2026-21514), Apple OS (CVE-2026-20700), Roundcube Webmail (CVE-2025-49113, CVE-2025-68461), and Google Chromium (CVE-2026-2441), all of which are under active exploitation. With 0% patch availability, implement network segmentation, restrict access to affected services, and increase endpoint detection sensitivity until vendor patches are released.

How to read this brief

CVSS score (e.g. 9.1) — severity from 0–10. Red marks critical (9+), orange high (7–8.9).

Exploitability — how hard the flaw is to attack, read from the CVSS vector:

  • Network / Adjacent / Local / Physical — how close an attacker must get. Network means reachable over the internet.
  • No / Low / High privileges — the access they need first. No privileges means no login required.
  • No interaction / User interaction — whether a victim has to do something (open a file, click a link). No interaction means fully automatable.

The lower the bar on all three, the easier to exploit at scale — “Network · No privileges · No interaction” is the worst case: hit from anywhere, no credentials, no victim action.

Actively exploited — confirmed under attack in the wild (CISA’s Known Exploited Vulnerabilities catalog). Prioritize these regardless of score.

EPSS · Nth percentile — FIRST.org’s estimated chance a flaw is exploited within 30 days. We flag it only in the top 10% — a statistical signal it’s unusually likely to be targeted, separate from whether attacks are confirmed.

💡 Tip: Swipe CVE cards left to ⭐ star, right to ❌ remove

Section Navigation