Microsoft Patch Tuesday security updates for February 2026 fix six actively exploited zero-day vulnerabilities.

Microsoft Patch Tuesday security updates for February 2026 fix 58 new security flaws across Windows, Office, Azure, Edge, Exchange, Hyper-V, WSL, and other components, rising to 62 CVEs when third-party updates are included. Five vulnerabilities are Critical, two Moderate, and most are rated Important. What stands out is that six flaws addressed this month are actively exploited in the wild, three of them publicly known.

Below are the six zero-day vulnerabilities addressed by the IT giant:

• CVE-2026-21510 (CVSS score of 7.5 – High)
  A Windows SmartScreen and Shell prompt bypass that allows attackers to evade security warnings by tricking users into opening a crafted malicious link or shortcut file.
• CVE-2026-21513 (CVSS score of 8.8 – High)
  An Internet Explorer security control bypass that can lead to code execution when a victim opens a malicious HTML page or LNK file.
• CVE-2026-21514 (CVSS score of 8.1 – High)
  A Microsoft 365 and Office flaw that bypasses OLE security mitigations, enabling malicious activity when a specially crafted Office document is opened.
• CVE-2026-21519 (CVSS score of 7.8 – High)
  A Windows Desktop Window Manager vulnerability that enables local privilege escalation and elevated system access.
• CVE-2026-21525 (CVSS score of 6.5 – Medium)
  A Windows Remote Access Connection Manager bug that can be abused by a local attacker to cause a denial-of-service condition.
• CVE-2026-21533 (CVSS score of 8.8 – High)
  A Windows Remote Desktop Services vulnerability that allows attackers to escalate privileges to SYSTEM.

Microsoft labeled CVE-2026-21510, CVE-2026-21514 and CVE-2026-21513 as “publicly disclosed”.

Microsoft credited Google Threat Intelligence Group, its internal security teams, and an anonymous researcher for discovering CVE-2026-21510 and CVE-2026-21514, while Microsoft and GTIG reported the vulnerability CVE-2026-21513.

- Advertisement -

EXPLORE MORE

Italian university La Sapienza still offline to mitigate recent cyber attack

Rome’s La Sapienza University was hit by a cyberattack that disrupted IT…

French Rafales and South Korean F-35As Deepen Strategic Airpower Cooperation in the Indo-Pacific

South Korean F-35A stealth fighters trained alongside French Rafales at Cheongju Air…

Kurt Weldon’s 9/11 Bombshell on Jimmy Dore

Former Republican Congressman Kurt Weldon—who served Pennsylvania's 7th district from 1987 to…

U.S. Expands F-35 Fighter Jet Support Network With $871 Million for Dispersed Combat Operations

The United States is expanding the sustainment network supporting its F-35 Lightning…

Wanted: Suspect for Shooting Incident in the 15th District [VIDEO]

The Philadelphia Police Department and the Shooting Investigation Unit is asking for…

US Steps Up Africa Push As China Expands Economic, Security Footprint

Authored by Arthur Zhang via The Epoch Times, The Trump administration says…

The full list of CVEs addressed by the Microsoft Patch Tuesday security update for February 2026 is available here.

Pierluigi Paganini