Root cause

Unpatched or unsupported software

A known vulnerability was left unfixed, or the software was past end of support. The most directly preventable cause on this list.

3 UK enforcement actions

£0 in penalties

3 sectors affected

The vulnerabilities behind this

Confirmed exploited in the wild and already past their remediation deadline — the definition of the failure the ICO keeps fining people for.

CVE-2026-114625 Arista VeloCloud Orchestrator SQL Injection Vulnerability Arista · VeloCloud Orchestrator Confirmed exploited CVSS 9.4 EPSS 1% 23 Oct 2026
CVE-2026-110447 Collabora Online – Built-in CODE Server OS Command Injection Vulnerability Collabora · Collabora Online – Built-in CODE Server Confirmed exploited CVSS 9.2 EPSS 12% 23 Oct 2026
CVE-2026-106931 EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability EG Secure Solutions · SiteGuard Server Edition Confirmed exploited CVSS 8.5 EPSS 3% 20 Oct 2026
CVE-2026-96656 Plex Media Server External Control of File Name or Path Vulnerability Plex · Media Server Confirmed exploited CVSS 8.6 EPSS 2% 20 Oct 2026
CVE-2026-96654 Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability Plex · Media Server Confirmed exploited CVSS 6.9 EPSS 2% 20 Oct 2026
CVE-2026-102764 BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability BeyondTrust · Remote Support Confirmed exploited CVSS 9.3 EPSS 19% 16 Oct 2026
CVE-2025-61624 Fortinet Multiple Products Path Traversal Vulnerability Fortinet · Multiple Products Confirmed exploited CVSS 6 EPSS 1% 16 Oct 2026
CVE-2026-21589 Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability Atlassian · Multiple Products Weaponised CVSS 9.3 EPSS 99% 15 Oct 2026
CVE-2026-105134 Ahsay AhsayCBS Command Injection Vulnerability Ahsay · AhsayCBS Weaponised CVSS 10 EPSS 82% 14 Oct 2026
CVE-2026-76519 Cisco Secure Email Gateway Relative Path Traversal Vulnerability Cisco · Secure Email Gateway Confirmed exploited CVSS 9.8 EPSS 2% 14 Oct 2026

Where it happens

Central government1
Online technology and telecoms1
Charitable and voluntary1

Every case

The Electoral Commission Reprimand issued to the Electoral Commission in respect of Articles 5(1)(f) and 32(1)(b). Between 24 August 2021 and 27 October 20… no fine Unpatched or unsupported software 09 May 2024
Gain Capital UK Limited Gain Capital UK have been issued a Reprimand in respect of Articles 32 (2) and 32 (1) (b). An unauthorised third party leveraged a… no fine Unpatched or unsupported software 10 Mar 2023
Chartered Institute for Securities & Investment An unauthorised third party exploited a known vulnerability in the Sitefinity software to leverage a bruteforce attack to upload a… no fine Unpatched or unsupported software 21 Feb 2023