February 2026 saw a 43% decrease in high-impact vulnerabilities, with Recorded Future's Insikt Group® identifying 13 vulnerabilities requiring immediate remediation, down from 23 in January 2026. All 13 carried a Very Critical Recorded Future Risk Score.
Introduction to Malware Binary Triage (IMBT) Course
Looking to level up your skills? Get 10% off using coupon code: MWNEWS10 for any flavor.
Enroll Now and Save 10%: Coupon Code MWNEWS10
Note: Affiliate link – your enrollment helps support this platform at no extra cost to you.
<p><strong>What security teams need to know:</strong></p>
<ul>
<li><strong>Microsoft dominates:</strong> Six of 13 vulnerabilities affected Microsoft products, accounting for 46% of February's findings; all were added to CISA's KEV catalog on the same day</li>
<li><strong>Supply-chain attack on Notepad++:</strong> Lotus Blossom, a suspected China state-sponsored threat actor, exploited CVE-2025-15556 to hijack Notepad++'s update channel and deliver a Cobalt Strike Beacon and the Chrysalis backdoor</li>
<li><strong>APT28 exploits MSHTML flaw:</strong> The Russian state-sponsored group leveraged CVE-2026-21513 via malicious Windows Shortcut files for multi-stage payload delivery</li>
<li><strong>Public exploits available:</strong> Four of 13 vulnerabilities have publicly available proof-of-concept code; an alleged exploit for a fifth is being advertised for sale</li>
</ul>
<p><strong>Bottom line:</strong> Despite a 43% drop in volume, February's vulnerabilities include named threat actor exploitation and five RCE-enabling flaws, making prioritized, intelligence-driven remediation as important as ever.</p>
<h2><strong>Quick Reference: February 2026 Vulnerability Table</strong></h2>
<p><em>All 13 vulnerabilities below were actively exploited in February 2026.</em></p>
<div>
<div>
<div><strong>#</strong></div>
<div><strong>Vulnerability</strong></div>
<div><strong>Risk</strong><br /><strong>Score</strong></div>
<div><strong>Affected Vendor/Product</strong></div>
<div><strong>Vulnerability Type/Component</strong></div>
<div><strong>Public PoC</strong></div>
</div>
<div>
<div>1</div>
<div><a href="https://app.recordedfuture.com/portal/intelligence-card/BD2JXlW/overview" rel="noreferrer" target="_blank">CVE-2025-15556</a></div>
<div>99</div>
<div>Notepad++</div>
<div>CWE-494 (Download of Code Without Integrity Check)</div>
<div><a href="https://github.com/George0Papasotiriou/CVE-2025-15556-Notepad-WinGUp-Updater-RCE" rel="noreferrer" target="_blank">Yes</a></div>
</div>
<div>
<div>2</div>
<div><a href="https://app.recordedfuture.com/portal/intelligence-card/BECGjWe/overview" rel="noreferrer" target="_blank">CVE-2026-1731</a></div>
<div>99</div>
<div>BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA)</div>
<div>CWE-78 (Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'))</div>
<div><a href="https://github.com/win3zz/CVE-2026-1731" rel="noreferrer" target="_blank">Yes</a></div>
</div>
<div>
<div>3</div>
<div><a href="https://app.recordedfuture.com/portal/intelligence-card/BEMKEF-/overview" rel="noreferrer" target="_blank">CVE-2026-21510</a></div>
<div>99</div>
<div>Microsoft Windows</div>
<div>CWE-693 (Protection Mechanism Failure)</div>
<div>No</div>
</div>
<div>
<div>4</div>
<div><a href="https://app.recordedfuture.com/portal/intelligence-card/BEMKEGB/overview" rel="noreferrer" target="_blank">CVE-2026-21513</a></div>
<div>99</div>
<div>Microsoft Windows</div>
<div>CWE-693 (Protection Mechanism Failure)</div>
<div>No</div>
</div>
<div>
<div>5</div>
<div><a href="https://app.recordedfuture.com/portal/intelligence-card/BEMKEGC/overview" rel="noreferrer" target="_blank">CVE-2026-21514</a></div>
<div>99</div>
<div>Microsoft Office</div>
<div>CWE-807 (Reliance on Untrusted Inputs in a Security Decision)</div>
<div>No</div>
</div>
<div>
<div>6</div>
<div><a href="https://app.recordedfuture.com/portal/intelligence-card/BEMKEGG/overview" rel="noreferrer" target="_blank">CVE-2026-21519</a></div>
<div>99</div>
<div>Microsoft Windows</div>
<div>CWE-843 (Access of Resource Using Incompatible Type ('Type Confusion'))</div>
<div>No</div>
</div>
<div>
<div>7</div>
<div><a href="https://app.recordedfuture.com/portal/intelligence-card/BEMKEGJ/overview" rel="noreferrer" target="_blank">CVE-2026-21525</a></div>
<div>99</div>
<div>Microsoft Windows</div>
<div>CWE-476 (NULL Pointer Dereference)</div>
<div>No</div>
</div>
<div>
<div>8</div>
<div><a href="https://app.recordedfuture.com/portal/intelligence-card/BEMKEGN/overview" rel="noreferrer" target="_blank">CVE-2026-21533</a></div>
<div>99</div>
<div>Microsoft Windows</div>
<div>CWE-269 (Improper Privilege Management)</div>
<div>*Yes</div>
</div>
<div>
<div>9</div>
<div><a href="https://app.recordedfuture.com/portal/intelligence-card/BEPyPC6/overview" rel="noreferrer" target="_blank">CVE-2026-20700</a></div>
<div>99</div>
<div>Apple iOS, macOS, tvOS, watchOS, and visionOS</div>
<div>CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer)</div>
<div>No</div>
</div>
<div>
<div>10</div>
<div><a href="https://app.recordedfuture.com/portal/intelligence-card/BEThw_R/overview" rel="noreferrer" target="_blank">CVE-2026-25108</a></div>
<div>99</div>
<div>Soliton Systems K.K. FileZen</div>
<div>CWE-78 (Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'))</div>
<div>No</div>
</div>
<div>
<div>11</div>
<div><a href="https://app.recordedfuture.com/portal/intelligence-card/BC48fmD/overview" rel="noreferrer" target="_blank">CVE-2026-2441</a></div>
<div>99</div>
<div>Google Chromium</div>
<div>CWE-416 (Use After Free)</div>
<div><a href="https://github.com/huseyinstif/CVE-2026-2441-PoC" rel="noreferrer" target="_blank">Yes</a></div>
</div>
<div>
<div>12</div>
<div><a href="https://app.recordedfuture.com/portal/intelligence-card/BEdM197/overview" rel="noreferrer" target="_blank">CVE-2026-22769</a></div>
<div>99</div>
<div>Dell RecoverPoint for Virtual Machines (RP4VMs)</div>
<div>CWE-798 (Use of Hard-coded Credentials)</div>
<div>No</div>
</div>
<div>
<div>13</div>
<div><a href="https://app.recordedfuture.com/portal/intelligence-card/BEzsB0i/overview" rel="noreferrer" target="_blank">CVE-2026-20127</a></div>
<div>99</div>
<div>Cisco Catalyst SD-WAN Controller and Manager</div>
<div>CWE-287 (Improper Authentication)</div>
<div><a href="https://github.com/search?q=CVE-2026-20127&type=repositories" rel="noreferrer" target="_blank">Yes</a></div>
</div>
</div>
<p><em><strong>Table 1:</strong></em> <em>List of vulnerabilities that were actively exploited in February based on Recorded Future data. *An alleged exploit for</em> <em><a href="https://app.recordedfuture.com/portal/intelligence-card/BEMKEGN/overview" rel="noreferrer" target="_blank">CVE-2026-21533</a></em> <em>is being advertised for sale across Github. Recorded Future Triage was used to browse the website advertising the exploit, which can be</em> <em><a href="https://tria.ge/260305-bl376shz8w/behavioral1#:~:text=v16-,Replay%20Monitor,-Downloads" rel="noreferrer" target="_blank">viewed here</a></em> <em>via the Replay Monitor. (Source: Recorded Future)</em></p>
<h2><strong>Key Trends: February 2026</strong></h2>
<h3><strong>Vendors Most Affected</strong></h3>
<ul>
<li><strong>Microsoft</strong> led with six vulnerabilities across Windows, Windows Server, Office, and Microsoft 365 products</li>
<li><strong>BeyondTrust</strong> faced a critical OS command injection flaw in Remote Support (RS) versions 25.3.1 and earlier, and Privileged Remote Access (PRA) versions 24.3.4 and earlier</li>
<li><strong>Cisco</strong> saw active exploitation of an authentication bypass in Catalyst SD-WAN infrastructure</li>
<li>Additional affected vendors: Notepad++, Apple, Soliton Systems K.K., Google, and Dell</li>
</ul>
<h3><strong>Most Common Weakness Types</strong></h3>
<ul>
<li><strong>CWE-78</strong> – OS Command Injection (tied for most common)</li>
<li><strong>CWE-693</strong> – Protection Mechanism Failure (tied for most common)</li>
<li><strong>CWE-476</strong> – NULL Pointer Dereference</li>
<li><strong>CWE-843</strong> – Type Confusion</li>
<li><strong>CWE-807</strong> – Reliance on Untrusted Inputs in a Security Decision</li>
</ul>
<h3><strong>Exploitation Activity</strong></h3>
<p><strong>Vulnerabilities associated with malware campaigns:</strong></p>
<ul>
<li><strong>Lotus Blossom</strong> (suspected China state-sponsored) exploited <strong>CVE-2025-15556</strong> to hijack Notepad++ update traffic between June and December 2025. The campaign rotated C2 servers across three attack chains to deliver a Metasploit loader, Cobalt Strike Beacon, and a custom backdoor called Chrysalis.</li>
<li><strong>APT28</strong> (Russian state-sponsored) exploited <strong>CVE-2026-21513</strong> using malicious Windows Shortcut (.lnk) files with embedded HTML payloads for multi-stage payload delivery, with observed network communication to infrastructure associated with the threat group.</li>
<li><strong>UNC6201</strong> (suspected China-nexus) exploited <strong>CVE-2026-22769</strong> to compromise Dell RecoverPoint for VMs appliances, deploying the SLAYSTYLE web shell, BRICKSTORM backdoor, and GRIMBOLT, a C#-based backdoor with native AOT compilation to complicate detection.</li>
</ul>
<p><strong>Long-running exploitation activity:</strong></p>
<ul>
<li><strong>UAT-8616</strong> exploited <strong>CVE-2026-20127</strong>, chaining it with CVE-2022-20775 to achieve root-level access on Cisco Catalyst SD-WAN systems, with <a href="https://blog.talosintelligence.com/uat-8616-sd-wan/" rel="noreferrer" target="_blank">Cisco Talos attributing</a> the activity to a sophisticated threat actor and assessing that the activity dates back to at least 2023.</li>
</ul>
<h2><strong>Priority Alert: Active Exploitation</strong></h2>
<p>These vulnerabilities demand immediate attention due to confirmed exploitation in the wild.</p>
<h3><strong>CVE-2025-15556 | Notepad++</strong></h3>
<p><strong>Risk Score: 99 (Very Critical)</strong> | CISA KEV: Added February 12, 2026</p>
<p><strong>Why this matters:</strong> Lotus Blossom exploited this flaw to replace legitimate Notepad++ update packages with malicious installers, deploying Cobalt Strike and the Chrysalis backdoor to targeted users over a six-month period. The vulnerability affects the WinGUp updater used by Notepad++ versions prior to 8.8.9, which fails to cryptographically verify downloaded update metadata and installers.</p>
<p><strong>Affected versions:</strong> Notepad++ versions prior to 8.8.9 (version 8.9.1 recommended)</p>
<p><strong>Immediate actions:</strong></p>
<ul>
<li>Update to Notepad++ version 8.9.1, released January 26, 2026</li>
<li>Hunt for the malicious update.exe sample (SHA256: 4d4aec6120290e21778c1b14c94aa6ebff3b0816fb6798495dc2eae165db4566) in your environment</li>
<li>Monitor for GUP.exe spawning unexpected child processes</li>
<li>Review network connections for traffic to 45[.]76[.]155[.]202, 45[.]77[.]31[.]210, 45[.]32[.]144[.]255, or 95[.]179[.]213[.]0</li>
<li>Check for directories named ProShow under %APPDATA% or unexpected files in %APPDATA%\Adobe\Scripts\</li>
<li>Block or alert on curl.exe uploading files to temp[.]sh</li>
</ul>
<p><strong>Known C2 infrastructure:</strong> 45[.]76[.]155[.]202, 45[.]77[.]31[.]210, cdncheck[.]it[.]com, safe-dns[.]it[.]com, 95[.]179[.]213[.]0</p>
<p><strong>Detection resources:</strong> Insikt Group created Sigma rules to detect update.exe's execution of reconnaissance commands (whoami, tasklist, systeminfo, and netstat -ano) and curl commands for system information exfiltration, available to Recorded Future customers.</p>
<div>
<div>
<div>
<img alt="" height="801" src="https://www.recordedfuture.com/media_155577ae992ec4ffecd3c5a7fa077ece6041dcb4c.png?width=750&format=png&optimize=medium" width="1600" />
</div>
</div>
<div>
<div><em><strong>Figure 1:</strong></em> <em>Risk Rules History from</em> <em><a href="https://www.recordedfuture.com/products/vulnerability-intelligence" rel="noreferrer" target="_blank">Vulnerability Intelligence</a></em> <em>Card® for CVE-2025-15556 in Recorded Future (Source: Recorded Future)</em></div>
</div>
</div>
Article Link: February 2026 CVE Landscape: 13 Critical Vulnerabilities Mark 43% Drop from January