Root cause

Unpatched or unsupported software

A known vulnerability was left unfixed, or the software was past end of support. The most directly preventable cause on this list.

3 UK enforcement actions

£0 in penalties

3 sectors affected

The vulnerabilities behind this

Confirmed exploited in the wild and already past their remediation deadline — the definition of the failure the ICO keeps fining people for.

CVE-2026-16232 Check Point SmartConsole Improper Authentication Vulnerability Check Point · SmartConsole Confirmed exploited CVSS 9.1 EPSS 13% 22 Jul 2026
CVE-2026-50522 Microsoft SharePoint Deserialization of Untrusted Data Vulnerability Microsoft · SharePoint Weaponised CVSS 9.8 EPSS 57% 22 Jul 2026
CVE-2026-63030 WordPress Core Interpretation Conflict Vulnerability WordPress · Core Weaponised CVSS 9.8 EPSS 98% 21 Jul 2026
CVE-2026-0770 Langflow Inclusion of Functionality from Untrusted Control Sphere Vulnerability Langflow · Langflow Weaponised CVSS 9.8 EPSS 56% 21 Jul 2026
CVE-2021-27137 DD-WRT Stack-Based Buffer Overflow Vulnerability DD-WRT · DD-WRT Confirmed exploited CVSS 8.1 EPSS 16% 21 Jul 2026
CVE-2026-58644 Microsoft SharePoint Deserialization of Untrusted Data Vulnerability Microsoft · SharePoint Confirmed exploited CVSS 9.8 EPSS 5% 16 Jul 2026
CVE-2026-25089 Fortinet FortiSandbox OS Command Injection Vulnerability Fortinet · FortiSandbox Weaponised CVSS 9.8 EPSS 70% 16 Jul 2026
CVE-2026-39808 Fortinet FortiSandbox OS Command Injection Vulnerability Fortinet · FortiSandbox Weaponised CVSS 9.8 EPSS 90% 16 Jul 2026
CVE-2026-46817 Oracle E-Business Suite Improper Privilege Management Vulnerability Oracle · E-Business Suite Confirmed exploited CVSS 9.8 EPSS 13% 15 Jul 2026
CVE-2026-56155 Microsoft Active Directory Federation Services Insufficient Granularity of Access Control Vulnerability Microsoft · Active Directory Federation Services Confirmed exploited CVSS 7.8 EPSS 2% 14 Jul 2026

Where it happens

Central government1
Online technology and telecoms1
Charitable and voluntary1

Every case

The Electoral Commission Reprimand issued to the Electoral Commission in respect of Articles 5(1)(f) and 32(1)(b). Between 24 August 2021 and 27 October 20… no fine Unpatched or unsupported software 09 May 2024
Gain Capital UK Limited Gain Capital UK have been issued a Reprimand in respect of Articles 32 (2) and 32 (1) (b). An unauthorised third party leveraged a… no fine Unpatched or unsupported software 10 Mar 2023
Chartered Institute for Securities & Investment An unauthorised third party exploited a known vulnerability in the Sitefinity software to leverage a bruteforce attack to upload a… no fine Unpatched or unsupported software 21 Feb 2023