Microsoft February 2026 Patch Tuesday - 59 CVEs, 6 Actively Exploited Zero-Days

The February 2026 Microsoft security updates (Patch Tuesday, released February 10/12, 2026) address a significant set of vulnerabilities across multiple products. This advisory summarizes verified facts from Microsoft's Security Update Guide and reliable security sources.

Severity Rating: High (due to multiple exploited zero-days, Critical-rated issues, and potential for RCE/EoP attacks)

Software Affected

• Microsoft Windows (including client and server versions, components like Kernel, Win32K, GDI+, HTTP.sys, Shell, Notepad, Remote Desktop, Desktop Window Manager, NTLM, LDAP, Hyper-V, etc.)
• Microsoft Office (Excel, Word, Outlook, and related components)
• Developer Tools (.NET, Visual Studio)
• Server Software (Exchange Server, etc.)
• SQL Server
• System Center
• Extended Security Updates (ESU) for legacy Microsoft products
• Apps (Power BI, Microsoft Defender for Linux, Windows App for Mac)
• Azure (SDK, Front Door, Arc, IoT SDK, HDInsights, Functions, DevOps Server, Compute Gallery, Local)
• GitHub Copilot (including Plugin for JetBrains IDEs and Visual Studio integration)
• Microsoft Edge (Chromium-based and Android)
• Internet Explorer (legacy MSHTML engine)
• Windows Subsystem for Linux (WSL)

Overview

Microsoft's February 2026 security release patches 59 Microsoft CVEs (plus 1 non-Microsoft/republished CVE, totaling around 60 issues). These vulnerabilities enable attackers to achieve remote code execution (RCE), elevation of privilege (EoP), security feature bypass, information disclosure, spoofing, denial of service (DoS), or other impacts. Six (6) vulnerabilities are actively exploited in the wild (zero-days), with at least three publicly disclosed prior to patching. Exploitation often requires minimal user interaction (e.g., clicking malicious links/shortcuts/files) or is remote with no privileges needed.

Target Audience

Individuals, IT administrators, security teams, and organizations managing Microsoft ecosystems, especially those using Windows, Office, Azure, or developer tools.

Risk Assessment

High risk due to exploited zero-days and Critical severity issues. Potential for remote exploitation leading to full system compromise, privilege escalation to SYSTEM level, data exfiltration, ransomware deployment, or widespread DoS.

Impact Assessment

• System compromise and unauthorized access
• Sensitive data exfiltration or leakage
• Ransomware or malware deployment
• System instability, crashes, or denial of service
• Bypass of security controls (e.g., SmartScreen, file execution prompts)

Description

The update addresses 59 Microsoft vulnerabilities, including:

• 2 Critical (CVSS 9.8): e.g., CVE-2026-21531 (Azure SDK), CVE-2026-24300 (Azure Front Door) – remote, no user interaction, high impact on C/I/A.
• 57 Important (CVSS 6.2–8.8): Majority of issues, covering RCE, EoP, info disclosure, DoS, security bypass.
• No Moderate or Low severities reported in the core release.

Key exploited zero-days (Exploitation Detected):

• CVE-2026-21510 (Windows Shell Security Feature Bypass) – Bypass SmartScreen/shell warnings via malicious link/shortcut → potential RCE (publicly disclosed).
• CVE-2026-21513 (MSHTML/Internet Explorer) – Bypass file execution prompts via malicious HTML/.lnk (publicly disclosed).
• CVE-2026-21514 (Microsoft Word) – Bypass protections for dangerous COM/OLE controls in documents (publicly disclosed).
• CVE-2026-21519 (Desktop Window Manager EoP).
• CVE-2026-21533 (Remote Desktop Services EoP to SYSTEM).
• One additional (e.g., related to Remote Access Connection Manager DoS).

Additional "Exploitation More Likely" issues include several in Windows components. No workarounds or mitigations are listed for most CVEs; patching is the primary solution.

For the complete list of CVEs, affected products, exploitability ratings, and details, refer to Microsoft's official release notes.

Solution

Apply the February 2026 security updates immediately via Windows Update, Microsoft Update, or manual downloads from the Microsoft Security Update Guide. Prioritize patching systems exposed to internet/untrusted inputs, Azure environments, and those handling Office documents/links. Test updates in staging environments where possible.