Zero-day report: January 2026
CISA added 17 exploited vulnerabilities to its catalog in January 2026, 3 fewer than December (20). 7 were zero-days, listed within a week of going public. 2 are known to be used by ransomware. The most-hit vendor was Microsoft, with 3.
By technology
Most-hit vendors
Every flaw added in January 2026
- Ivanti · Endpoint Manager Mobile (EPMM)Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability
- Fortinet · Multiple ProductsFortinet Multiple Products Authentication Bypass Using an Alternate Path or Channel Vulnerability
- Linux · KernelLinux Kernel Integer Overflow Vulnerability
- SmarterTools · SmarterMailSmarterTools SmarterMail Unrestricted Upload of File with Dangerous Type Vulnerability
- Microsoft · OfficeMicrosoft Office Security Feature Bypass Vulnerability
- SmarterTools · SmarterMailSmarterTools SmarterMail Authentication Bypass Using an Alternate Path or Channel Vulnerability
- GNU · InetUtilsGNU InetUtils Argument Injection Vulnerability
- VMware · VMware vCenter ServerBroadcom VMware vCenter Server Out-of-bounds Write Vulnerability
- Vite · VitejsVite Vitejs Improper Access Control Vulnerability
- Versa · ConcertoVersa Concerto Improper Authentication Vulnerability
- Prettier · eslint-config-prettierPrettier eslint-config-prettier Embedded Malicious Code Vulnerability
- Synacor · Zimbra Collaboration Suite (ZCS)Synacor Zimbra Collaboration Suite (ZCS) PHP Remote File Inclusion Vulnerability
- Cisco · Unified Communications ManagerCisco Unified Communications Products Code Injection Vulnerability
- Microsoft · WindowsMicrosoft Windows Information Disclosure Vulnerability
- Gogs · GogsGogs Path Traversal Vulnerability
- Microsoft · OfficeMicrosoft Office PowerPoint Code Injection Vulnerability
- Hewlett Packard Enterprise (HPE) · OneViewHewlett Packard Enterprise (HPE) OneView Code Injection Vulnerability
← December 2025February 2026 →
Source: CISA's Known Exploited Vulnerabilities catalog, by the date CISA added each flaw. Ransomware use is CISA's flag.