CISA flags four active-exploit vulns affecting enterprise infrastructure

CISA added four vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog on 2026-02-12, based on evidence of active exploitation in the wild. The CVEs affect Microsoft Configuration Manager (SQL injection), Notepad++ (unsigned code download), SolarWinds Web Help Desk (security control bypass), and Apple (buffer overflow). KEV catalog inclusion signals imminent risk and typically triggers mandatory remediation timelines for federal contractors and critical infrastructure operators.

Primary connection is Power Projection via operational risk: unpatched vulnerabilities in Configuration Manager and Web Help Desk degrade command-and-control reliability, system visibility, and network integrity — all prerequisites for force readiness. Secondary connection to Market Forces: mandatory patching cycles create vendor lock-in and budget pressure for contractors managing legacy infrastructure.

Limited geopolitical angle unless attribution reveals state-sponsored exploitation; if confirmed, this becomes an intelligence/counterintel story. The connection is contained to cyber defense posture, not cross-domain strategy.

WHY IT MATTERS

Defense contractors and federal IT operations must prioritize patching these four vulnerabilities immediately.

Microsoft Configuration Manager and SolarWinds Web Help Desk are standard in enterprise environments across DoD and civilian agencies; Configuration Manager in particular manages system configurations across large networks, making SQL injection exposure a direct path to lateral movement and privilege escalation.

The SolarWinds inclusion is notable given the SolarWinds supply-chain compromise history (2020) — this suggests continued exploitation of their products in operational networks. For program managers: KEV inclusion typically triggers CISO mandate compliance within 30 days for federal systems and 60 days for contractors.

This forces immediate allocation of patch-and-test resources, potentially delaying non-critical updates. The breadth (Microsoft, Apple, SolarWinds, Notepad++) suggests no single vendor or sector is immune, but Windows-heavy defense IT will face the highest operational friction.

WHAT THIS DOESN’T TELL US

The article does not specify: (1) how widespread active exploitation is (number of compromised systems or organizations), (2) whether any federal agencies or contractors have already been breached via these CVEs, (3) patch availability and complexity for each CVE, or (4) whether any of these vulnera...

CISA flags four active-exploit vulns affecting enterprise infrastructure

Fault Lines