---
title: "Security digest: February 10, 2026"
url: https://erroneo.us/security/2026-02-10/
description: "February 10, 2026 vulnerability digest: 1 brief (FortiOS CVE-2025-68686: SSL-VPN Symlink Patch…); 6 CISA KEV additions (Microsoft); 3 critical advisories…"
type: security-digest-day
section: "Security Digest"
date_published: 2026-02-10
date_modified: 2026-07-27
publisher: erroneo.us
author: erroneo.us Security Desk
license: All rights reserved. Quote with attribution and a link.
---

# Security digest: February 10, 2026

1 editorial brief, 6 known exploited (cisa kev) additions and 3 critical advisories.

## Take stock

- Check exposure: FortiOS CVE-2025-68686: SSL-VPN Symlink Patch Bypass in KEV . FortiGate owners on FortiOS 6.4, 7.0, 7.2, 7.4 before 7.4.7 or 7.6 before 7.6.2 whose devices have ever had SSL-VPN enabled, above all units that were exposed to older SSL-VPN bugs.
- Do you run any of these? Microsoft Windows, Microsoft Office. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2026-03-03.
- npm: 1 critical advisory ( @casl/ability ). Check with npm audit (or: npm ls <package>) .
- Maven: 1 critical advisory ( org.apache.druid.extensions:druid-basic-security ). Check with mvn dependency:tree -Dincludes=<groupId>:<artifactId> .
- PyPI: 1 critical advisory ( azure-ai-language-conversations-authoring ). Check with pip-audit (or: pip show <package>) .
- None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

## Editorial briefs

- **Check exposure** [FortiOS CVE-2025-68686: SSL-VPN Symlink Patch Bypass in KEV](https://erroneo.us/security/briefs/fortios-ssl-vpn-symlink-patch-bypass-cve-2025-68686/index.md): This is not a way in, only a way to stay in on FortiGates that ran SSL-VPN and were already breached; the real problem is that FortiOS 7.2, 7.0 and 6.4 will never get a fix, so plan the move to 7.4.7+ or 7.6.2+.

## Known exploited (CISA KEV)

- [CVE-2026-21533](https://erroneo.us/security/cve/CVE-2026-21533/index.md) Microsoft Windows: Microsoft Windows Improper Privilege Management Vulnerability (CISA due 2026-03-03)
- [CVE-2026-21525](https://erroneo.us/security/cve/CVE-2026-21525/index.md) Microsoft Windows: Microsoft Windows NULL Pointer Dereference Vulnerability (CISA due 2026-03-03)
- [CVE-2026-21519](https://erroneo.us/security/cve/CVE-2026-21519/index.md) Microsoft Windows: Microsoft Windows Type Confusion Vulnerability (CISA due 2026-03-03)
- [CVE-2026-21514](https://erroneo.us/security/cve/CVE-2026-21514/index.md) Microsoft Office: Microsoft Office Word Reliance on Untrusted Inputs in a Security Decision Vulnerability (CISA due 2026-03-03)
- [CVE-2026-21513](https://erroneo.us/security/cve/CVE-2026-21513/index.md) Microsoft Windows: Microsoft MSHTML Framework Protection Mechanism Failure Vulnerability (CISA due 2026-03-03)
- [CVE-2026-21510](https://erroneo.us/security/cve/CVE-2026-21510/index.md) Microsoft Windows: Microsoft Windows Shell Protection Mechanism Failure Vulnerability (CISA due 2026-03-03)

## Critical advisories

- [CVE-2026-1774](https://erroneo.us/security/cve/CVE-2026-1774/index.md) CASL Ability is Vulnerable to Prototype Pollution — npm @casl/ability >= 2.4.0, <= 6.7.4 → 6.7.5
- [CVE-2026-23906](https://erroneo.us/security/cve/CVE-2026-23906/index.md) Apache Druid Vulnerable to Authentication Bypass — Maven org.apache.druid.extensions:druid-basic-security >= 0.17.0, < 36.0.0 → 36.0.0
- [CVE-2026-21531](https://erroneo.us/security/cve/CVE-2026-21531/index.md) Azure AI Language Authoring Elevation of Privilege Vulnerability can Lead to RCE — PyPI azure-ai-language-conversations-authoring < 1.0.0b4 → 1.0.0b4

---
Source page: https://erroneo.us/security/2026-02-10/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt