Monday, February 23, 2026 Archive

Archived Security Snapshot

Critical vulnerabilities, curated daily for security professionals

Archived Security Brief

Monday's vulnerability disclosures reveal significant exposure across Microsoft Windows and Office products, with multiple actively exploited flaws targeting core enterprise infrastructure. The brief includes 1 critical vulnerability (down 50% from prior day) and 63 high-priority CVEs (down 37%), reflecting a quieter but still consequential disclosure cycle. CVE-2026-24494 (CVSS 9.8) affects the Online Ordering System, while five Microsoft Windows CVEs and one Office CVE are confirmed under active exploitation. Notably, legacy vulnerabilities in GitLab, Zimbra, Roundcube Webmail, and Sangoma FreePBX continue to see exploitation activity, underscoring persistent risk from unpatched older systems. Patch availability stands at 0%, making compensating controls and network-level mitigations essential until vendor fixes are released.

  • Microsoft Windows and Office account for 6 actively exploited vulnerabilities across remote code execution and privilege escalation vectors
  • 1 critical CVE disclosed (CVSS 9.8), down 50% from the prior day's 2 critical vulnerabilities
  • 63 high-priority CVEs (CVSS 7.0-8.9), a 37% decrease from the prior day's 100 high-priority disclosures
  • Active exploitation spans Roundcube Webmail, GitLab, Sangoma FreePBX, Google Chromium, and Apple OS — covering email, DevOps, VoIP, and browser attack surfaces
  • Patch availability is at 0% — no vendor fixes are currently available for disclosed vulnerabilities
  • 21 CVEs have confirmed active exploitation, consistent with the prior day's count

Immediate action: Prioritize reviewing exposure to Microsoft Windows, Office, Roundcube Webmail, and GitLab environments, as these face confirmed active exploitation with no patches currently available. Implement network segmentation, access restrictions, and enhanced monitoring for affected systems as compensating controls until vendor patches are released.

How to read this brief

CVSS score (e.g. 9.1) — severity from 0–10. Red marks critical (9+), orange high (7–8.9).

Exploitability — how hard the flaw is to attack, read from the CVSS vector:

  • Network / Adjacent / Local / Physical — how close an attacker must get. Network means reachable over the internet.
  • No / Low / High privileges — the access they need first. No privileges means no login required.
  • No interaction / User interaction — whether a victim has to do something (open a file, click a link). No interaction means fully automatable.

The lower the bar on all three, the easier to exploit at scale — “Network · No privileges · No interaction” is the worst case: hit from anywhere, no credentials, no victim action.

Actively exploited — confirmed under attack in the wild (CISA’s Known Exploited Vulnerabilities catalog). Prioritize these regardless of score.

EPSS · Nth percentile — FIRST.org’s estimated chance a flaw is exploited within 30 days. We flag it only in the top 10% — a statistical signal it’s unusually likely to be targeted, separate from whether attacks are confirmed.

💡 Tip: Swipe CVE cards left to ⭐ star, right to ❌ remove

Section Navigation