- 26/2026
- Critical
Microsoft has released its monthly patch of security updates, known as Patch Tuesday. The mentioned patch addressed six actively exploited and three publicly disclosed zero-day vulnerabilities.
Microsoft has fixed (59) vulnerabilities that could allow the attacker to gain elevated privileges, perform denial-of-service attacks, obtain sensitive information, conduct spoofing attacks, bypass security restrictions, or execute arbitrary code and gain access to the affected systems.
February’s Patch Tuesday was released to fix security flaws in several Microsoft products such as .NET and Visual Studio, Desktop Window Manager, Windows Subsystem for Linux, Mailslot File System, Windows Kernel, Windows Shell, Windows Storage, Windows Remote Access Connection Manager, Windows Subsystem for Linux, Microsoft Graphics Component, Windows Cluster Client Failover, Windows LDAP – Lightweight Directory Access Protocol, and Windows Remote Desktop.
The actively exploited zero-day vulnerabilities in February’s Patch are:
- Windows Shell Security Feature Bypass Vulnerability “CVE-2026-21510” allows the attacker to bypass security.
- MSHTML Framework Security Feature Bypass Vulnerability “CVE-2026-21513” allows the unauthorized attacker to bypass a security feature over a network.
- Microsoft Word Security Feature Bypass Vulnerability “CVE-2026-21514” allows the attacker to bypass security.
- Desktop Window Manager Elevation of Privilege Vulnerability “CVE-2026- 21519” allows the attacker to gain elevated privileges.
- Windows Remote Access Connection Manager Denial of Service Vulnerability “CVE-2026 21525” allows the unauthorized attacker to deny service locally.
- Windows Remote Desktop Services Elevation of Privilege Vulnerability “CVE- 2026-21533” allows the authorized attacker to gain elevated privileges locally.
The publicly disclosed zero-day flaws are:
- Windows Shell Security Feature Bypass Vulnerability “CVE-2026-21510” allows the attacker to bypass security.
- MSHTML Framework Security Feature Bypass Vulnerability “CVE-2026-21513” allows the unauthorized attacker to bypass a security feature over a network.
- Microsoft Word Security Feature Bypass Vulnerability “CVE-2026-21514” allows the attacker to bypass security.
Sample of the addressed vulnerabilities:
1- Azure SDK for Python Remote Code Execution Vulnerability (CVE-2026- 21531):
- CVSS: 9.8
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: Low
- User Interaction: None
- Consequences: Gain Access
2- M365 Copilot Information Disclosure Vulnerability (CVE-2026-24307):
- CVSS: 9.3
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Consequences: Obtain Information
Vulnerabilities
Mitigations
The enterprise should deploy this patch as soon as the testing phase is completed.