Microsoft Patch Tuesday Updates for February 2026

Key Findings

• Microsoft released security updates to address 58 new vulnerabilities across Windows, Office, Azure, Edge, Exchange, Hyper-V, and other components.

• The update includes fixes for 6 zero-day vulnerabilities that are being actively exploited in the wild.

• 5 of the vulnerabilities were rated as "Critical" by Microsoft.

• Several vulnerabilities affect high-profile targets like GitHub Copilot, IDEs, and Azure cloud services.

Background

This month's Patch Tuesday from Microsoft addresses a significant set of security issues, including 6 zero-day vulnerabilities that are already being actively exploited by attackers. The updates touch a wide range of Microsoft products, from the Windows operating system to cloud services and developer tools.

Windows Zero-Days

• CVE-2026-21510: Security feature bypass in Windows Shell allowing bypass of security prompts.

• CVE-2026-21513: Security feature bypass in MSHTML framework enabling code execution.

• CVE-2026-21514: Security bypass in Microsoft Word allowing malicious code execution.

• CVE-2026-21519: Privilege escalation in Desktop Window Manager.

• CVE-2026-21533: Privilege escalation in Windows Remote Desktop Services.

• CVE-2026-21525: Denial-of-service in Windows Remote Access Connection Manager.

Cloud and Developer Tool Vulnerabilities

• CVE-2026-21228: Improper certificate validation in Azure Local enabling remote code execution.

• CVE-2026-20841: Remote code execution vulnerability in Microsoft Notepad.

• CVE-2026-21244, CVE-2026-21248: Remote code execution flaws in Windows Hyper-V.

• CVE-2026-21516, CVE-2026-21523, CVE-2026-21256: Remote code execution vulnerabilities in GitHub Copilot.

Recommendations

• Apply the February 2026 Patch Tuesday updates as soon as possible to address the actively exploited zero-day vulnerabilities.

• Closely monitor systems and applications for any issues or regressions after applying the updates.

• Review access controls and least-privilege principles, especially for developer and cloud-based tools.

• Ensure robust backup and disaster recovery procedures are in place.

Sources

• https://krebsonsecurity.com/2026/02/patch-tuesday-february-2026-edition/

• https://blog.talosintelligence.com/microsoft-patch-tuesday-february-2026/

• https://securityaffairs.com/187848/uncategorized/microsoft-patch-tuesday-security-updates-for-february-2026-fix-six-actively-exploited-zero-days.html

• https://www.bleepingcomputer.com/news/microsoft/microsoft-february-2026-patch-tuesday-fixes-6-zero-days-58-flaws/

• https://blog.qualys.com/vulnerabilities-threat-research/2026/02/10/microsoft-patch-tuesday-february-2026-security-update-review

• https://www.lansweeper.com/blog/patch-tuesday/microsoft-patch-tuesday-february-2026/