Microsoft February 2026 Patch Tuesday: 58 Flaws Fixed, 6 Zero-Days Under Attack
Microsoft has rolled out its February 2026 Patch Tuesday updates, addressing 58 security vulnerabilities across Windows and related products. This month’s release is particularly critical, with six actively exploited zero-day vulnerabilities and three publicly disclosed flaws now patched.
Key Highlights
- Total vulnerabilities fixed: 58
- Actively exploited zero-days: 6
- Publicly disclosed zero-days: 3
- Critical vulnerabilities: 5 (3 elevation of privilege, 2 information disclosure)
Vulnerability Breakdown
- 25 Elevation of Privilege
- 5 Security Feature Bypass
- 12 Remote Code Execution
- 6 Information Disclosure
- 3 Denial of Service
- 7 Spoofing
(Note: Microsoft Edge flaws patched earlier this month are not included in this count.)
Actively Exploited Zero-Day Vulnerabilities
Microsoft confirmed six zero-days under active attack:
- CVE-2026-21510 – Windows Shell Security Feature Bypass (likely Mark of the Web bypass)
- CVE-2026-21513 – MSHTML Framework Security Feature Bypass
- CVE-2026-21514 – Microsoft Word Security Feature Bypass (OLE mitigations bypass)
- CVE-2026-21519 – Desktop Window Manager Elevation of Privilege (SYSTEM access)
- CVE-2026-21525 – Windows Remote Access Connection Manager Denial of Service
- CVE-2026-21533 – Windows Remote Desktop Services Elevation of Privilege
Publicly disclosed before patching: CVE-2026-21510, CVE-2026-21513, CVE-2026-21514.
Secure Boot Certificate Rollout
Alongside security fixes, Microsoft has begun deploying new Secure Boot certificates to replace the original 2011 versions, which expire in June 2026. The rollout is phased, with devices receiving updates only after showing successful update signals to ensure stability.
Other Vendor Security Updates (February 2026)
- Adobe: Updates for Audition, After Effects, InDesign, Lightroom Classic, and more.
- BeyondTrust: Critical RCE patch for Remote Support (RS) and Privileged Remote Access (PRA).
- CISA: Directive requiring removal of unsupported network edge devices.
- Cisco: Fixes for Secure Web Appliance and Meeting Management.
- Fortinet: Updates for FortiOS and FortiSandbox.
- Google: Android February bulletin (no fixes).
- n8n: Patch bypass fix for CVE-2025-68613.
- SAP: Multiple product updates, including two critical vulnerabilities.
Extra Note for Admins
Microsoft is also testing built-in Sysmon functionality in Windows 11 Insider builds — a welcome addition for IT teams relying on Sysmon for system monitoring.
Why This Patch Tuesday Matters
This month’s release is one of the most important in recent memory:
- Multiple actively exploited zero-days across Windows core components and Office.
- A major infrastructure change with Secure Boot certificate updates.
- Critical updates across the wider software ecosystem (Adobe, Cisco, Fortinet, SAP).
Recommendation: IT administrators should prioritize patching systems immediately, especially those vulnerable to the six zero-days.
Follow Us On – X.com, Telegram, LinkedIN, Discord Server,
For The Latest Updates, Vulnerability Insights, Security News, Cyberattack Scoops And Cybersecurity Best Practices Delivered Straight To Your Inbox – Subscribe To Our Newsletter
