Microsoft February 2026 Patch Tuesday Fixes 6 Zero-Days, 58 Security Flaws
Microsoft February 2026 Patch Tuesday Fixes 6 Zero-Days, 58 Security Flaws
Redmond, Washington — Microsoft has released its February 2026 Patch Tuesday security update, addressing a total of 58 vulnerabilities across Windows, Office and other key products — including six actively exploited zero-day vulnerabilities that were being used by attackers before patches were available.
This month’s update is notable both for the sheer number of flaws fixed and for the urgency of some of the issues, with multiple vulnerabilities already leveraged in real-world attacks and several publicly disclosed before being patched.
🔒 Six Actively Exploited Zero-Day Vulnerabilities
Among the patches are six zero-day vulnerabilities that Microsoft confirmed were actively exploited in the wild. Three of these had been publicly disclosed prior to the update:
- CVE-2026-21510 — Windows Shell Security Feature Bypass: Attackers could bypass SmartScreen and Shell warnings by convincing users to open malicious links or shortcut files.
- CVE-2026-21513 — MSHTML Framework Security Bypass: A flaw in the MSHTML rendering engine allowed attackers to bypass security protections when malicious HTML or link files are opened.
- CVE-2026-21514 — Microsoft Word Security Bypass: Malicious Office files could evade built-in protections, executing unsafe code when opened.
- CVE-2026-21519 — Desktop Window Manager Privilege Escalation: Local attackers could elevate privileges to SYSTEM level.
- CVE-2026-21525 — Windows Remote Access Connection Manager DoS: A denial-of-service flaw allowing attackers with local access to disrupt system connectivity.
- CVE-2026-21533 — Windows Remote Desktop Services Privilege Escalation: This flaw enabled attackers to elevate privileges within Remote Desktop Services.
Security experts say the prominence of zero-days — particularly those that bypass security prompts and protections — makes this update urgent for both enterprise and home users.
🛡️ Other Vulnerabilities and Fixes
Beyond the zero-days, Microsoft patched a broad range of other serious flaws:
- 25 elevation of privilege vulnerabilities
- 12 remote code execution vulnerabilities
- 5 security feature bypass vulnerabilities
- 6 information disclosure flaws
- 3 denial of service vulnerabilities
- 7 spoofing vulnerabilities
In addition, five vulnerabilities were rated “Critical” — a designation indicating potential for severe impact if exploited, particularly in enterprise environments.
🔄 Rolling Out Updated Secure Boot Certificates
As part of this Patch Tuesday, Microsoft also began the phased rollout of updated Secure Boot certificates to replace legacy certificates expiring later this year. This transition aims to maintain trusted boot processes on Windows devices and prevent malware persistence during system startup.
📌 What Users Should Do
Microsoft and security analysts recommend that all users and administrators install the February updates immediately, especially on systems exposed to the internet or handling untrusted files and email attachments. Immediate patching is crucial to block exploitation of the zero-day flaws that were already being actively abused by attackers.
The February 2026 Patch Tuesday Security Updates
Below is the complete list of resolved vulnerabilities in the February 2026 Patch Tuesday updates.
To access the full description of each vulnerability and the systems it affects, you can view the full report here.
| Tag | CVE ID | CVE Title | Severity |
|---|---|---|---|
| .NET | CVE-2026-21218 | .NET Spoofing Vulnerability | Important |
| Azure Arc | CVE-2026-24302 | Azure Arc Elevation of Privilege Vulnerability | Critical |
| Azure Compute Gallery | CVE-2026-23655 | Microsoft ACI Confidential Containers Information Disclosure Vulnerability | Critical |
| Azure Compute Gallery | CVE-2026-21522 | Microsoft ACI Confidential Containers Elevation of Privilege Vulnerability | Critical |
| Azure DevOps Server | CVE-2026-21512 | Azure DevOps Server Cross-Site Scripting Vulnerability | Important |
| Azure Front Door (AFD) | CVE-2026-24300 | Azure Front Door Elevation of Privilege Vulnerability | Critical |
| Azure Function | CVE-2026-21532 | Azure Function Information Disclosure Vulnerability | Critical |
| Azure HDInsights | CVE-2026-21529 | Azure HDInsight Spoofing Vulnerability | Important |
| Azure IoT SDK | CVE-2026-21528 | Azure IoT Explorer Information Disclosure Vulnerability | Important |
| Azure Local | CVE-2026-21228 | Azure Local Remote Code Execution Vulnerability | Important |
| Azure SDK | CVE-2026-21531 | Azure SDK for Python Remote Code Execution Vulnerability | Important |
| Desktop Window Manager | CVE-2026-21519 | Desktop Window Manager Elevation of Privilege Vulnerability | Important |
| Github Copilot | CVE-2026-21516 | GitHub Copilot for Jetbrains Remote Code Execution Vulnerability | Important |
| GitHub Copilot and Visual Studio | CVE-2026-21523 | GitHub Copilot and Visual Studio Code Remote Code Execution Vulnerability | Important |
| GitHub Copilot and Visual Studio | CVE-2026-21256 | GitHub Copilot and Visual Studio Remote Code Execution Vulnerability | Important |
| GitHub Copilot and Visual Studio | CVE-2026-21257 | GitHub Copilot and Visual Studio Elevation of Privilege Vulnerability | Important |
| GitHub Copilot and Visual Studio Code | CVE-2026-21518 | GitHub Copilot and Visual Studio Code Security Feature Bypass Vulnerability | Important |
| Mailslot File System | CVE-2026-21253 | Mailslot File System Elevation of Privilege Vulnerability | Important |
| Microsoft Defender for Linux | CVE-2026-21537 | Microsoft Defender for Endpoint Linux Extension Remote Code Execution Vulnerability | Important |
| Microsoft Edge (Chromium-based) | CVE-2026-1861 | Chromium: CVE-2026-1861 Heap buffer overflow in libvpx | Unknown |
| Microsoft Edge (Chromium-based) | CVE-2026-1862 | Chromium: CVE-2026-1862 Type Confusion in V8 | Unknown |
| Microsoft Edge for Android | CVE-2026-0391 | Microsoft Edge (Chromium-based) for Android Spoofing Vulnerability | Moderate |
| Microsoft Exchange Server | CVE-2026-21527 | Microsoft Exchange Server Spoofing Vulnerability | Important |
| Microsoft Graphics Component | CVE-2026-21246 | Windows Graphics Component Elevation of Privilege Vulnerability | Important |
| Microsoft Graphics Component | CVE-2026-21235 | Windows Graphics Component Elevation of Privilege Vulnerability | Important |
| Microsoft Office Excel | CVE-2026-21261 | Microsoft Excel Information Disclosure Vulnerability | Important |
| Microsoft Office Excel | CVE-2026-21258 | Microsoft Excel Information Disclosure Vulnerability | Important |
| Microsoft Office Excel | CVE-2026-21259 | Microsoft Excel Elevation of Privilege Vulnerability | Important |
| Microsoft Office Outlook | CVE-2026-21260 | Microsoft Outlook Spoofing Vulnerability | Important |
| Microsoft Office Outlook | CVE-2026-21511 | Microsoft Outlook Spoofing Vulnerability | Important |
| Microsoft Office Word | CVE-2026-21514 | Microsoft Word Security Feature Bypass Vulnerability | Important |
| MSHTML Framework | CVE-2026-21513 | MSHTML Framework Security Feature Bypass Vulnerability | Important |
| Power BI | CVE-2026-21229 | Power BI Remote Code Execution Vulnerability | Important |
| Role: Windows Hyper-V | CVE-2026-21244 | Windows Hyper-V Remote Code Execution Vulnerability | Important |
| Role: Windows Hyper-V | CVE-2026-21255 | Windows Hyper-V Security Feature Bypass Vulnerability | Important |
| Role: Windows Hyper-V | CVE-2026-21248 | Windows Hyper-V Remote Code Execution Vulnerability | Important |
| Role: Windows Hyper-V | CVE-2026-21247 | Windows Hyper-V Remote Code Execution Vulnerability | Important |
| Windows Ancillary Function Driver for WinSock | CVE-2026-21236 | Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability | Important |
| Windows Ancillary Function Driver for WinSock | CVE-2026-21241 | Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability | Important |
| Windows Ancillary Function Driver for WinSock | CVE-2026-21238 | Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability | Important |
| Windows App for Mac | CVE-2026-21517 | Windows App for Mac Installer Elevation of Privilege Vulnerability | Important |
| Windows Cluster Client Failover | CVE-2026-21251 | Cluster Client Failover (CCF) Elevation of Privilege Vulnerability | Important |
| Windows Connected Devices Platform Service | CVE-2026-21234 | Windows Connected Devices Platform Service Elevation of Privilege Vulnerability | Important |
| Windows GDI+ | CVE-2026-20846 | GDI+ Denial of Service Vulnerability | Important |
| Windows HTTP.sys | CVE-2026-21240 | Windows HTTP.sys Elevation of Privilege Vulnerability | Important |
| Windows HTTP.sys | CVE-2026-21250 | Windows HTTP.sys Elevation of Privilege Vulnerability | Important |
| Windows HTTP.sys | CVE-2026-21232 | Windows HTTP.sys Elevation of Privilege Vulnerability | Important |
| Windows Kernel | CVE-2026-21231 | Windows Kernel Elevation of Privilege Vulnerability | Important |
| Windows Kernel | CVE-2026-21222 | Windows Kernel Information Disclosure Vulnerability | Important |
| Windows Kernel | CVE-2026-21239 | Windows Kernel Elevation of Privilege Vulnerability | Important |
| Windows Kernel | CVE-2026-21245 | Windows Kernel Elevation of Privilege Vulnerability | Important |
| Windows LDAP – Lightweight Directory Access Protocol | CVE-2026-21243 | Windows Lightweight Directory Access Protocol (LDAP) Denial of Service Vulnerability | Important |
| Windows Notepad App | CVE-2026-20841 | Windows Notepad App Remote Code Execution Vulnerability | Important |
| Windows NTLM | CVE-2026-21249 | Windows NTLM Spoofing Vulnerability | Important |
| Windows Remote Access Connection Manager | CVE-2026-21525 | Windows Remote Access Connection Manager Denial of Service Vulnerability | Moderate |
| Windows Remote Desktop | CVE-2026-21533 | Windows Remote Desktop Services Elevation of Privilege Vulnerability | Important |
| Windows Shell | CVE-2026-21510 | Windows Shell Security Feature Bypass Vulnerability | Important |
| Windows Storage | CVE-2026-21508 | Windows Storage Elevation of Privilege Vulnerability | Important |
| Windows Subsystem for Linux | CVE-2026-21237 | Windows Subsystem for Linux Elevation of Privilege Vulnerability | Important |
| Windows Subsystem for Linux | CVE-2026-21242 | Windows Subsystem for Linux Elevation of Privilege Vulnerability | Important |
| Windows Win32K – GRFX | CVE-2023-2804 | Red Hat, Inc. CVE-2023-2804: Heap Based Overflow libjpeg-turbo | Important |
Don’t forget to follow us @bigblogreport.com or www.bigblogreport.com
