Zero-day report: March 2026
CISA added 26 exploited vulnerabilities to its catalog in March 2026, 2 fewer than February (28). 7 were zero-days, listed within a week of going public. 2 are known to be used by ransomware. The most-hit vendor was Apple, with 6.
By technology
Most-hit vendors
Every flaw added in March 2026
- Citrix · NetScalerCitrix NetScaler Out-of-Bounds Read Vulnerability
- F5 · BIG-IPF5 BIG-IP Stack-Based Buffer Overflow Vulnerability
- Aquasecurity · TrivyAquasecurity Trivy Embedded Malicious Code Vulnerability
- Langflow · LangflowLangflow Code Injection Vulnerability
- Apple · Multiple ProductsApple Multiple Products Buffer Overflow Vulnerability
- Craft CMS · Craft CMSCraft CMS Code Injection Vulnerability
- Apple · Multiple ProductsApple Multiple Products Improper Locking Vulnerability
- Apple · Multiple ProductsApple Multiple Products Classic Buffer Overflow Vulnerability
- Laravel · LivewireLaravel Livewire Code Injection Vulnerability
- Cisco · Secure Firewall Management Center (FMC)Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management Deserialization of Untrusted Data Vulnerability
- Synacor · Zimbra Collaboration Suite (ZCS)Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting Vulnerability
- Microsoft · SharePointMicrosoft SharePoint Deserialization of Untrusted Data Vulnerability
- Wing FTP Server · Wing FTP ServerWing FTP Server Information Disclosure Vulnerability
- Google · SkiaGoogle Skia Out-of-Bounds Write Vulnerability
- Google · Chromium V8Google Chromium V8 Improper Restriction of Operations Within the Bounds of a Memory Buffer Vulnerability
- n8n · n8nn8n Improper Control of Dynamically-Managed Code Resources Vulnerability
- Omnissa · Workspace One UEMOmnissa Workspace ONE Server-Side Request Forgery
- SolarWinds · Web Help DeskSolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability
- Ivanti · Endpoint Manager (EPM)Ivanti Endpoint Manager (EPM) Authentication Bypass Vulnerability
- Hikvision · Multiple ProductsHikvision Multiple Products Improper Authentication Vulnerability
- Rockwell · Multiple ProductsRockwell Multiple Products Insufficient Protected Credentials Vulnerability
- Apple · Multiple ProductsApple Multiple Products Integer Overflow or Wraparound Vulnerability
- Apple · iOS and iPadOSApple iOS and iPadOS Use-After-Free Vulnerability
- Apple · Multiple ProductsApple Multiple products Use-After-Free Vulnerability
- Qualcomm · Multiple ChipsetsQualcomm Multiple Chipsets Memory Corruption Vulnerability
- VMware · VMware Aria OperationsBroadcom VMware Aria Operations Command Injection Vulnerability
Source: CISA's Known Exploited Vulnerabilities catalog, by the date CISA added each flaw. Ransomware use is CISA's flag.