Microsoft today released updates to fix more than 50 security holes in its Windows operating systems and other software, including patches for six 'zero-day' vulnerabilities that attackers are already exploiting. Zero-day #1 this month is CVE-2026-21510, a security feature bypass vulnerability in the Windows Shell where a single click on a malicious link can quietly bypass Windows protections and run attacker-controlled content without warning or consent dialogs. CVE-2026-21513 is a security bypass bug targeting MSHTML, the proprietary engine of the default Web browser in Windows. CVE-2026-21514 is a related security feature bypass vulnerability in Microsoft Word. The zero-day CVE-2026-21533 allows local attackers to elevate their user privileges to 'SYSTEM' level access in Windows Remote Desktop Services. CVE-2026-21519 is a zero-day elevation of privilege flaw in the Desktop Window Manager (DWM), a key component of Windows that organizes windows on a user’s screen. Microsoft fixed a different zero-day in DWM just last month. The sixth zero-day is CVE-2026-21525, a potentially disruptive denial-of-service vulnerability in the Windows Remote Access Connection Manager, the service responsible for maintaining VPN connections to corporate networks.
Patch Tuesday, February 2026 Edition
Summary: This month’s Patch Tuesday brought more than 50 security updates from Microsoft, addressing critical vulnerabilities in Windows and other software.
Key facts
- Microsoft issued more than 50 security updates on Patch Tuesday, February 2026.
- Six zero-day vulnerabilities were patched, with the potential to exploit critical system functions.
- The patches address issues in Windows Shell, MSHTML, Microsoft Word, Remote Desktop Services, and the Desktop Window Manager.
Why it matters
These patches are crucial as they address vulnerabilities that were being actively exploited, posing significant risks to users and organizations. The presence of multiple zero-days highlights the ongoing threat landscape and underscores the importance of timely patch management in cybersecurity.
Key metrics
- Number of Security Patches Issued: >50 (This month’s Patch Tuesday update.)
- Number of Zero-Day Vulnerabilities Patched: 6 (Critical vulnerabilities that were actively exploited.)