Microsoft Patch Tuesday February 2026 Fixes 54 Flaws, 6 Zero-Days Under Active Exploitation

Microsoft’s February 2026 Patch Tuesday update has arrived with critical urgency, addressing 54 security vulnerabilities across its ecosystem.

This month’s release is particularly severe due to the inclusion of six zero-day vulnerabilities that are currently being exploited in the wild.

Security teams are urged to prioritize these updates immediately to prevent system compromise.

The Six Actively Exploited Zero-Days

The most alarming aspect of this update is the volume of “active exploits”, flaws that attackers were already abusing before Microsoft could release a fix.

• CVE-2026-21510 (Windows Shell Security Feature Bypass): This vulnerability allows attackers to bypass “Mark of the Web” (MoTW) security warnings, which typically alert users to dangerous files downloaded from the internet.
• CVE-2026-21519 (Desktop Window Manager Elevation of Privilege): A type confusion flaw in the Desktop Window Manager (DWM) that enables an attacker to gain SYSTEM-level privileges, effectively taking full control of the machine.
• CVE-2026-21533 (Windows Remote Desktop Services EoP): Improper privilege management in Remote Desktop Services allows authenticated attackers to elevate their permissions to SYSTEM.​
• CVE-2026-21513 (MSHTML Platform Security Feature Bypass): This bug in the MSHTML engine allows malicious files (like shortcuts) to bypass security prompts and execute code without the user’s knowledge.​
• CVE-2026-21514 (Microsoft Word Security Feature Bypass): Attackers can use malicious Office files to bypass OLE mitigations, a defense mechanism designed to block vulnerable controls.​
• CVE-2026-21525 (Windows Remote Access Connection Manager DoS): A null pointer dereference flaw that can be exploited to cause a Denial of Service (DoS), crashing VPN connections for users.

Beyond the zero-days, Microsoft update addresses dozens of other flaws.

Actively Exploited Zero-Day Vulnerabilities

These six flaws are currently being used in attacks. Immediate patching is required.

CVE ID	Vulnerability Title	Severity	CVSS
CVE-2026-21510	Windows Shell Security Feature Bypass	Important	7.8
CVE-2026-21513	MSHTML Platform Security Feature Bypass	Important	7.5
CVE-2026-21514	Microsoft Word Security Feature Bypass	Important	7.8
CVE-2026-21519	Desktop Window Manager Elevation of Privilege	Important	7.8
CVE-2026-21525	Windows Remote Access Connection Manager DoS	Important	7.5
CVE-2026-21533	Windows Remote Desktop Services Elevation of Privilege	Important	7.8

Critical & Notable Vulnerabilities

This table includes other high-risk flaws, particularly those affecting enterprise infrastructure like Exchange and Azure.

CVE ID	Vulnerability Title	Severity	Type
CVE-2026-21527	Microsoft Exchange Server Spoofing Vulnerability	Critical	Spoofing / RCE Vector
CVE-2026-23655	Azure Container Instances Information Disclosure	Critical	Information Disclosure
CVE-2026-21518	GitHub Copilot / VS Code Remote Code Execution	Important	RCE / Command Injection
CVE-2026-21528	Azure IoT SDK Vulnerability	Important	Remote Code Execution
CVE-2026-21531	Azure SDK Vulnerability	Important	Remote Code Execution
CVE-2026-21222	Windows Kernel Information Disclosure	Important	Information Disclosure
CVE-2026-21249	Windows NTLM Spoofing Vulnerability	Moderate	Spoofing
CVE-2026-21509	Microsoft Office Security Feature Bypass	Important	Security Feature Bypass

Elevation of Privilege (EoP) vulnerabilities dominate the list, accounting for nearly half of the patches. Notable critical fixes include:​

• Microsoft Exchange Server (CVE-2026-21527): A remote code execution flaw that remains a high-value target for enterprise attackers.​
• Azure Services: Multiple flaws were patched in Azure Data Studio, Azure Arc, and Azure Front Door, highlighting the need to secure cloud-adjacent infrastructure.​

A summary of the 54 flaws fixed in this release, categorized by impact.

Vulnerability Type	Count	Key Risk
Elevation of Privilege (EoP)	25	Attackers gaining SYSTEM/Admin rights (e.g., CVE-2026-21519)
Remote Code Execution (RCE)	12	Critical server-side flaws (e.g., Exchange, Azure)
Spoofing	7	NTLM coercion and identity masking
Information Disclosure	6	Leaking memory or sensitive data
Security Feature Bypass	5	Evading MoTW (Mark of the Web) or Defender
Denial of Service (DoS)	3	Crashing services (e.g., VPN Manager)

Given the high number of active exploits, this is a “patch now” event. Administrators should focus first on the six zero-days and the Exchange Server updates.

Testing should be conducted quickly to ensure compatibility, but the risk of delay is extreme.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google