CISA orders federal agencies to patch exploited SolarWinds, Apple, Microsoft bugs within weeks

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

CISA Adds New Vulnerabilities to Known Exploited Catalog The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added several new vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, including flaws in SolarWinds Web Help Desk, Notepad++, Microsoft Configuration Manager, and Apple devices on February 13, 2026. Additionally, on February 11, 2026, CISA included vulnerabilities in Microsoft Office and Microsoft Windows in the same catalog. These updates aim to inform organizations about critical security issues that require immediate attention. 94 sources 47