erroneo.us
Search all guides⌘K

Digest · Tuesday

Security digest: February 10, 2026

1 editorial brief, 6 known exploited (cisa kev) additions and 3 critical advisories.

All digests · RSS · Markdown

Take stock

  • Check exposure: FortiOS CVE-2025-68686: SSL-VPN Symlink Patch Bypass in KEV. FortiGate owners on FortiOS 6.4, 7.0, 7.2, 7.4 before 7.4.7 or 7.6 before 7.6.2 whose devices have ever had SSL-VPN enabled, above all units that were exposed to older SSL-VPN bugs.
  • Do you run any of these? Microsoft Windows, Microsoft Office. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2026-03-03.
  • npm: 1 critical advisory (@casl/ability). Check with npm audit (or: npm ls <package>).
  • Maven: 1 critical advisory (org.apache.druid.extensions:druid-basic-security). Check with mvn dependency:tree -Dincludes=<groupId>:<artifactId>.
  • PyPI: 1 critical advisory (azure-ai-language-conversations-authoring). Check with pip-audit (or: pip show <package>).
  • None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Editorial briefs

Check exposure

· Vulnerability · CVE-2025-68686

FortiOS CVE-2025-68686: SSL-VPN Symlink Patch Bypass in KEV

This is not a way in, only a way to stay in on FortiGates that ran SSL-VPN and were already breached; the real problem is that FortiOS 7.2, 7.0 and 6.4 will never get a fix, so plan the move to 7.4.7+ or 7.6.2+.

Must act: FortiGate owners on FortiOS 6.4, 7.0, 7.2, 7.4 before 7.4.7 or 7.6 before 7.6.2 whose devices have ever had SSL-VPN enabled, above all units that were exposed to older SSL-VPN bugs.

Can relax: FortiGates that never had SSL-VPN enabled (Fortinet says they are not impacted), devices already on 7.4.7+ or 7.6.2+, and teams with no Fortinet gear.

  1. Run get system status on every FortiGate and list units on 6.4, 7.0, 7.2, 7.4 before 7.4.7 or 7.6 before 7.6.2.
  2. Upgrade to FortiOS 7.4.7+ or 7.6.2+ using Fortinet's upgrade path; 7.2, 7.0 and 6.4 have no fix and must migrate.
  3. Until then, keep the AV/IPS engine licensed and enabled and apply the FG-VD-60389.0day virtual patch.

Read the brief →

Known exploited (CISA KEV) 6

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

CVEProduct and flawCISA due
CVE-2026-21533Microsoft Windows
Microsoft Windows Improper Privilege Management Vulnerability		2026-03-03
CVE-2026-21525Microsoft Windows
Microsoft Windows NULL Pointer Dereference Vulnerability		2026-03-03
CVE-2026-21519Microsoft Windows
Microsoft Windows Type Confusion Vulnerability		2026-03-03
CVE-2026-21514Microsoft Office
Microsoft Office Word Reliance on Untrusted Inputs in a Security Decision Vulnerability		2026-03-03
CVE-2026-21513Microsoft Windows
Microsoft MSHTML Framework Protection Mechanism Failure Vulnerability		2026-03-03
CVE-2026-21510Microsoft Windows
Microsoft Windows Shell Protection Mechanism Failure Vulnerability		2026-03-03

Critical advisories by ecosystem 3

GitHub-reviewed advisories rated critical, published this day (Pacific time).

Maven 1

Check: mvn dependency:tree -Dincludes=<groupId>:<artifactId>

npm 1

Check: npm audit (or: npm ls <package>)

PyPI 1

Check: pip-audit (or: pip show <package>)