# february 2026

> markdown for agents. every page and download is listed in [llms.txt](https://cvegen.art/llms.txt).

![drybrush poster for february 2026, painted from 4,616 published cves](https://media.cvegen.art/posters/2026-02/1280.jpg?v=9d83aacd09)

what the poster shows: 28 days as bands of dry brush, the first day at the top. 16 ran above the 2025 average for their weekday and sweep fast and wide; the other 12 are slow, level strokes. two inks: the deep one for open-source packages, enterprise vendors, the linux kernel, browsers and ai software, the pale one for everything else.

the poster being painted, a 12 second film: [mp4](https://media.cvegen.art/films/2026-02.mp4?v=85f51daea9)

| fact | value |
| --- | --- |
| cves | 4,616 |
| against an average 2025 month | 1.2× |
| busiest day | feb 19, 388 |
| rated critical, cvss 9 or higher | 451 |
| critical with no login and no click | 370 |
| used in real attacks | 20 |

## february 2026 in numbers

february 2026 brought 4,616 cves, 1.2 times an average 2025 month. 16 of its 28 days ran above the 2025 average for that weekday.

- 388 on feb 19, the busiest day.
- 451 rated critical, cvss 9 or higher. 370 of them can be hit over the network with no login and nothing for a user to click.
- 1,474 in open-source packages, 3.3 times their 2025 monthly average. no other kind of software grew as fast.
- 337 came in two single drops: patchstack 213 on feb 20, github 124 on feb 25.

## 20 already used in real attacks

cisa kev, as of oct 24.

### by product

- 5 microsoft windows, feb 10
- 2 cisco catalyst sd-wan manager, feb 25
- 1 notepad++, feb 3
- 1 beyondtrust remote support and privileged remote access, feb 6
- 1 fortinet forticlient ems, feb 6
- 1 fortinet fortios, feb 10
- 1 ivanti endpoint manager, feb 10
- 1 microsoft office, feb 10
- 1 apple products, feb 11
- 1 google chromium, feb 13
- 1 soliton systems k.k filezen, feb 13
- 1 dell recoverpoint for virtual machines, feb 17
- 1 broadcom vmware aria operations, feb 25
- 1 cisco catalyst sd-wan controller and manager, feb 25
- 1 cisco catalyst sd-wan manger, feb 25

### every cve

- feb 3, notepad++ notepad++, [cve-2025-15556](https://www.cve.org/CVERecord?id=CVE-2025-15556)
- feb 6, beyondtrust remote support (rs) and privileged remote access (pra), [cve-2026-1731](https://www.cve.org/CVERecord?id=CVE-2026-1731)
- feb 6, fortinet forticlient ems, [cve-2026-21643](https://www.cve.org/CVERecord?id=CVE-2026-21643)
- feb 10, fortinet fortios, [cve-2025-68686](https://www.cve.org/CVERecord?id=CVE-2025-68686)
- feb 10, ivanti endpoint manager (epm), [cve-2026-1603](https://www.cve.org/CVERecord?id=CVE-2026-1603)
- feb 10, microsoft windows, [cve-2026-21510](https://www.cve.org/CVERecord?id=CVE-2026-21510)
- feb 10, microsoft windows, [cve-2026-21513](https://www.cve.org/CVERecord?id=CVE-2026-21513)
- feb 10, microsoft office, [cve-2026-21514](https://www.cve.org/CVERecord?id=CVE-2026-21514)
- feb 10, microsoft windows, [cve-2026-21519](https://www.cve.org/CVERecord?id=CVE-2026-21519)
- feb 10, microsoft windows, [cve-2026-21525](https://www.cve.org/CVERecord?id=CVE-2026-21525)
- feb 10, microsoft windows, [cve-2026-21533](https://www.cve.org/CVERecord?id=CVE-2026-21533)
- feb 11, apple multiple products, [cve-2026-20700](https://www.cve.org/CVERecord?id=CVE-2026-20700)
- feb 13, google chromium, [cve-2026-2441](https://www.cve.org/CVERecord?id=CVE-2026-2441)
- feb 13, soliton systems k.k filezen, [cve-2026-25108](https://www.cve.org/CVERecord?id=CVE-2026-25108)
- feb 17, dell recoverpoint for virtual machines (rp4vms), [cve-2026-22769](https://www.cve.org/CVERecord?id=CVE-2026-22769)
- feb 25, cisco catalyst sd-wan manger, [cve-2026-20122](https://www.cve.org/CVERecord?id=CVE-2026-20122)
- feb 25, cisco catalyst sd-wan controller and manager, [cve-2026-20127](https://www.cve.org/CVERecord?id=CVE-2026-20127)
- feb 25, cisco catalyst sd-wan manager, [cve-2026-20128](https://www.cve.org/CVERecord?id=CVE-2026-20128)
- feb 25, cisco catalyst sd-wan manager, [cve-2026-20133](https://www.cve.org/CVERecord?id=CVE-2026-20133)
- feb 25, broadcom vmware aria operations, [cve-2026-22719](https://www.cve.org/CVERecord?id=CVE-2026-22719)

cisa keeps adding older cves when attacks come to light, so this list can still grow.

## this poster

| fact | value |
| --- | --- |
| period | february 1 to 28, 2026 |
| cves | 4,616 |
| data | cve list v5, cisa kev, drawn 2026-10-24 |
| format | 3:4, drawn for 45 × 60 cm |

[download jpg, 2000 × 2667](https://media.cvegen.art/posters/2026-02/2000.jpg?v=9d83aacd09)

## other months

- before: [january 2026](https://cvegen.art/2026/01.md), 4,302 cves
- after: [march 2026](https://cvegen.art/2026/03.md), 6,236 cves
- [all months](https://cvegen.art/index.md)