CISA's list that day
3 February 2026
On CISA added 4 vulnerabilities to its list of exploited vulnerabilities, in Sangoma FreePBX, GitLab Community and Enterprise Editions and SolarWinds Web Help Desk. The US federal deadlines run from to .
Added that day
| Vulnerability | Product | Our group | Listed | Deadline | EPSS |
|---|---|---|---|---|---|
| CVE-2025-40551Deserialization of Untrusted Data | SolarWinds Web Help Desk | Patch this weekMetasploit module; EPSS 0.84 | 0.84 | ||
| CVE-2025-64328OS Command Injection | Sangoma FreePBX | Patch this weekMetasploit module; EPSS 0.85 | 0.85 | ||
| CVE-2019-19006Improper Authentication | Sangoma FreePBX | Patch this weekEPSS 0.56 | 0.56 | ||
| CVE-2021-39935Server-Side Request Forgery (SSRF) | GitLab Community and Enterprise Editions | Patch soon | 0.36 |