February 2026 CVE Landscape: 13 Critical Vulnerabilities Mark 43% Drop from January
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2022-20775 | Path Traversal Privilege Escalation in Cisco SD-WAN Software CLI | 7.8 | 12% | KEVPoC | KEV |
| CVE-2025-15556 | Unverified updates in Notepad++ WinGUp updater allow arbitrary code execution | 7.7 | 2% | KEV | KEV |
| CVE-2026-1731 | Pre-Authentication OS Command Injection RCE in BeyondTrust Remote Support and PRA | 9.9 | 94% | KEVRansomwarePoC | KEV |
| CVE-2026-20127 | Authentication Bypass in Cisco Catalyst SD-WAN Controller, Manager, Validator | 10.0 | 88% | KEV | KEV |
CVE-2026-21513+1 related CVE | MSHTML Security Feature Bypass in Windows Exploited in the Wild (CVE-2026-21513) | 8.8 group max | 16% | KEV | KEV |
| CVE-2026-22769 | Hard-coded credentials in Dell RecoverPoint for Virtual Machines allow root OS access | 10.0 | 14% | KEV | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | cdncheck.it.com | C2 infrastructure: 45[.]76[.]155[.]202, 45[.]77[.]31[.]210, cdncheck[.]it[.]com, safe-dns[.]it[.]com, 95[.]179[.]213[.]0 Detection reso |
| domain | safe-dns.it.com | [.]76[.]155[.]202, 45[.]77[.]31[.]210, cdncheck[.]it[.]com, safe-dns[.]it[.]com, 95[.]179[.]213[.]0 Detection resources: Insikt Group c |
| domain | temp.sh | dobe\Scripts\ Block or alert on curl.exe uploading files to temp[.]sh Known C2 infrastructure: 45[.]76[.]155[.]202, 45[.]77[.]3 |
| domain | wellnesscaremed.com | igation flow. The .lnk initiates network communication with wellnesscaremed[.]com as part of APT28's multistage payload delivery. SHA256 fo |
| ipv4 | 45.76.155.202 | d child processes Review network connections for traffic to 45[.]76[.]155[.]202, 45[.]77[.]31[.]210, 45[.]32[.]144[.]255, or 95[.]179 |
| ipv4 | 45.77.31.210 | iew network connections for traffic to 45[.]76[.]155[.]202, 45[.]77[.]31[.]210, 45[.]32[.]144[.]255, or 95[.]179[.]213[.]0 Check for |
| sha256 | 4d4aec6120290e21778c1b14c94aa6ebff3b0816fb6798495dc2eae165db4566 | 26, 2026 Hunt for the malicious update.exe sample (SHA256: 4d4aec6120290e21778c1b14c94aa6ebff3b0816fb6798495dc2eae165db4566) in your environment Monitor for GUP.exe spawning unexpecte |
| sha256 | aefd15e3c395edd16ede7685c6e97ca0350a702ee7c8585274b457166e86b1fa | age payload delivery. SHA256 for document.doc.LnK.download: aefd15e3c395edd16ede7685c6e97ca0350a702ee7c8585274b457166e86b1fa Why this matters: APT28's use of a weaponized .lnk file exp |
| url | https://45.77.31.210/users/admin | ader, which retrieved a Cobalt Strike Beacon shellcode from hxxps://45[.]77[.]31[.]210/users/admin and executed it. Chain 2 (September 2025): Reused the |
From the original article
8 min read at recordedfuture.com
February 2026 saw a 43% decrease in high-impact vulnerabilities, with Recorded Future's Insikt Group® identifying 13 vulnerabilities requiring immediate remediation, down from 23 in January 2026 . All 13 carried a ‘Very Critical’ Recorded Future Risk Score.
By Recorded Future® · recordedfuture.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.