Full Report
February 2026 saw a 43% decrease in high-impact vulnerabilities, with Recorded Future's Insikt Group® identifying 13 vulnerabilities requiring immediate remediation, down from 23 in January 2026.
Analysis Summary
As a vulnerability research specialist, I have synthesized the February 2026 threat landscape report. While the volume of high-impact vulnerabilities decreased by 43% from the previous month, the remaining 13 flaws are marked by active exploitation by state-sponsored actors and critical supply-chain compromises.
Below are the structured summaries for the most significant vulnerabilities identified in the report.
---
# Vulnerability: Notepad++ Supply-Chain Hijack (Lotus Blossom)
## CVE Details
- **CVE ID:** CVE-2025-15556
- **CVSS Score:** 9.8 - 9.9 (Very Critical / Risk Score 99)
- **CWE:** CWE-494 (Download of Code Without Integrity Check)
## Affected Systems
- **Products:** Notepad++
- **Versions:** Specifically affecting the WinGUp (Windows Generic Updater) component.
- **Configurations:** Systems configured to receive automatic or manual updates via the built-in update channel.
## Vulnerability Description
The vulnerability resides in the Notepad++ update mechanism, which fails to properly verify the integrity of downloaded code. Threat actors (Lotus Blossom) hijacked the update channel to deliver malicious payloads instead of legitimate software updates.
## Exploitation
- **Status:** **Exploited in the wild** (Suspected China state-sponsored). Delivering Cobalt Strike Beacon and Chrysalis backdoor.
- **Complexity:** Medium (Requires infrastructure/channel takeover).
- **Attack Vector:** Network (Update Channel).
- **PoC Available:** Yes (GitHub - hxxps[://]github[.]com/George0Papasotiriou/CVE-2025-15556-Notepad-WinGUp-Updater-RCE).
## Impact
- **Confidentiality:** High (Full data exfiltration capability).
- **Integrity:** High (Execution of arbitrary backdoors).
- **Availability:** High (Full system takeover).
## Remediation
### Patches
- Users should update Notepad++ to the latest version via the official website (manually) to ensure the local updater is patched.
### Workarounds
- Disable "Auto-Updater" in Notepad++ settings.
- Implement network egress filtering to block unauthorized connections from the `notepad++.exe` process.
## Detection
- **Indicators:** Execution of reconnaissance commands such as `whoami`, `tasklist`, and `netstat -ano` immediately following an update.
- **Methods:** Sigma rules monitoring for `curl`-based exfiltration from the Notepad++ directory.
---
# Vulnerability: BeyondTrust Remote Management RCE
## CVE Details
- **CVE ID:** CVE-2026-1731
- **CVSS Score:** 9.9 (Very Critical)
- **CWE:** CWE-78 (OS Command Injection)
## Affected Systems
- **Products:** BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA).
- **Versions:** RS versions 25.3.1 and earlier; PRA versions 24.3.4 and earlier.
## Vulnerability Description
A failure to properly neutralize special elements in OS commands allows an attacker to inject and execute arbitrary commands on the underlying operating system of the management appliance.
## Exploitation
- **Status:** **Exploited in the wild.**
- **Complexity:** Low.
- **Attack Vector:** Network.
- **PoC Available:** Yes (GitHub - hxxps[://]github[.]com/win3zz/CVE-2026-1731).
## Remediation
### Patches
- Update BeyondTrust RS to versions later than 25.3.1.
- Update BeyondTrust PRA to versions later than 24.3.4.
---
# Vulnerability: Microsoft MSHTML / Windows Shortcut Flaw
## CVE Details
- **CVE ID:** CVE-2026-21513
- **CVSS Score:** 9.9 (Very Critical)
- **CWE:** CWE-693 (Protection Mechanism Failure)
## Affected Systems
- **Products:** Microsoft Windows (various versions).
- **Configurations:** Systems processing malicious Windows Shortcut (.LNK) files.
## Vulnerability Description
A failure in a protection mechanism allows the MSHTML engine to be leveraged through malicious shortcut files. This bypasses security prompts to facilitate multi-stage payload delivery.
## Exploitation
- **Status:** **Exploited in the wild** (APT28 / Russian state-sponsored).
- **Complexity:** Low.
- **Attack Vector:** Network / User Interaction.
- **PoC Available:** No.
## Remediation
### Patches
- Apply February 2026 Microsoft Security Updates. This CVE is currently listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.
---
# Vulnerability: Dell RecoverPoint Hard-coded Credentials
## CVE Details
- **CVE ID:** CVE-2026-22769
- **CVSS Score:** 9.9 (Very Critical)
- **CWE:** CWE-798 (Use of Hard-coded Credentials)
## Affected Systems
- **Products:** Dell RecoverPoint for Virtual Machines (RP4VMs).
- **Configurations:** Deployments utilizing default system accounts.
## Vulnerability Description
The presence of hard-coded credentials allows attackers to gain unauthorized access to the virtual machine recovery environment, often used as a pivot point for lateral movement into VMware infrastructure.
## Exploitation
- **Status:** **Exploited in the wild.** Associated with the deployment of SLAYSTYLE and GRIMBOLT backdoors.
- **Complexity:** Low.
- **Attack Vector:** Network.
## Remediation
### Patches
- Consult Dell security advisories for specific RP4VMs patch versions.
### Workarounds
- Change all default administrative credentials immediately.
- Implement Single Packet Authorization (SPA) to gate access to management interfaces.
---
# Additional Critical Vulnerabilities (February 2026)
| CVE ID | Product | CWE Type | PoC Status |
| :--- | :--- | :--- | :--- |
| **CVE-2026-20127** | Cisco Catalyst SD-WAN | Auth Bypass (CWE-287) | Yes |
| **CVE-2026-2441** | Google Chromium | Use After Free (CWE-416) | Yes |
| **CVE-2026-21533** | MS Windows | PrivEsc (CWE-269) | **Exploit for Sale** |
| **CVE-2026-20700** | Apple (iOS/macOS) | Buffer Overflow (CWE-119) | No |
| **CVE-2026-25108** | Soliton FileZen | Command Injection (CWE-78) | No |
## References
- Recorded Future Insikt Group: hxxps[://]app[.]recordedfuture[.]com/portal/intelligence-card/overview
- CISA Known Exploited Vulnerabilities Catalog: hxxps[://]www[.]cisa[.]gov/known-exploited-vulnerabilities-catalog