Microsoft is publishing 55 vulnerabilities this February 2026 Patch Tuesday . Microsoft is aware of exploitation in the wild for six of today’s vulnerabilities, and notes public disclosure for three of those. Earlier in the month, Microsoft provided patches to address three browser vulnerabilities, which are not included in the Patch Tuesday count above.
All three of the publicly disclosed zero-day vulnerabilities published today are security feature bypasses, and Microsoft acknowledges the same cast of reporters in each case.
CVE-2026-21510 describes a zero-day Windows Shell security feature bypass vulnerability which is already exploited in the wild. Not to be confused with PowerShell, most people will use the Windows Shell without ever learning its name or even really contemplating its existence. The Windows Shell is Microsoft’s term for the GUI interaction logic for the entire OS provided by explorer.exe and associated libraries and APIs.
CVE-2026-21510 provides an attacker with a way to dodge those pesky Smart Screen or other “are you sure?” prompts. The advisory sets out that “an attacker must convince a user to open a malicious link or shortcut file”. We could parse this wording more than one way, and while shortcut files with a .lnk extension are certainly a prime suspect here, it’s possible that .url files might also be a vector.
The venerable MSHTML/Trident web rendering engine is still present in Windows as a daily driver for Office and Explorer, many years after most people stopped using Internet Explorer. Accordingly, every so often Microsoft has to patch another zero-day vulnerability in the browser it can’t quite bring itself to rip out of its flagship operating system. Today’s example is CVE-2026-21513 , a security feature bypass which starts with the attacker convincing a user to open a malicious HTML file or shortcut file.
If good things come in threes, then perhaps CVE-2026-21514 makes security bypass zero-day vulnerabilities a good thing. Exploitation involves bypassing Object Linking & Embedding (OLE) mitigations by convincing the user to open a malicious Word document. The advisory only lists remediations for LTSC versions of Office and on-prem Microsoft 365 Apps for Enterprise, without mentioning the standard Microsoft 365 suite.
It’s curious that Microsoft has evaluated the attack vector for CVE-2026-21514 as local, because MSRC typically assesses any vulnerability which boils down to “remote attacker tricks user into opening malicious payload” as a remote attack, based on the location of the attacker. However, the advisory specifically calls out that “reliance on untrusted inputs in a security decision in Microsoft Office Word allows an unauthorized attacker to bypass a security feature locally.” It’s not clear whether this is a deviation from prior practice by MSRC, an inadvertent mis-assessment, or an unusual-but-correct assessment of an attack vector that relies on details which Microsoft has not made public. Happily, the Preview Pane is not a vector, which raises the bar slightly for an attacker, since the user must explicitly open the malicious file or web page.
Ultimately, although none of the advisories for CVE-2026-21510 , CVE-2026-21513 , or CVE-2026-21514 explicitly come out and say it, it’s likely that exploitation in each case involves tricking Windows into participating in another Mark-of the Web laundering scheme using flaws in old components.
For the second month in a row , the Windows Desktop Windows Manager (DWM) is the site of an exploited-in-the-wild zero-day vulnerability. Last month’s CVE-2026-20805 was an information disclosure vulnerability, effectively a treasure map for threat actors seeking the otherwise obfuscated in-memory address of the kernel-space DWM process. The publication of zero-day elevation of privilege (EoP) vulnerability CVE-2026-21519 today very likely reflects MSTIC and MSRC working to thwart the same threat actor in both cases. As Rapid7 has noted in the past, initial access coupled with local elevation of privilege vulnerabilities is the staple diet of many successful attackers, so the lower CVSS v3 base score of 7.8 seen here versus a broadly equivalent remote code execution is not a sign to delay patching.
Remote Desktop Services (RDP) are designed to allow a duly authorized remote user to interact with the server, but CVE-2026-21533 allows an unauthorized local user to elevate privileges to SYSTEM. Every Windows Server product back as far as Server 2012 receives patches, so this one has been present for a while. It’s possible that today’s patches close off a long-running exploitation story for at least one threat actor.
Exploited in the wild, but perhaps of less concern is CVE-2026-21525 , a local denial of service vulnerability in the Windows Remote Access Connection Manager (RasMan). Somewhat unusually for a local vulnerability, the advisory sets out that no privileges are required at all, so even a guest account can exploit this one. You have disabled those guest accounts, right?
There are no significant Microsoft product lifecycle changes this month.
Windows Notepad App Remote Code Execution Vulnerability
Exploitation Less Likely
Azure DevOps Server Cross-Site Scripting Vulnerability
Exploitation Less Likely
Azure HDInsight Spoofing Vulnerability
Exploitation Unlikely
Azure IoT Explorer Information Disclosure Vulnerability
Exploitation Unlikely
Azure Local Remote Code Execution Vulnerability
Exploitation Less Likely
Azure SDK for Python Remote Code Execution Vulnerability
Exploitation Less Likely
Microsoft ACI Confidential Containers Elevation of Privilege Vulnerability
Exploitation Less Likely
Microsoft ACI Confidential Containers Information Disclosure Vulnerability
Exploitation Less Likely
.NET Spoofing Vulnerability
Exploitation Unlikely
GitHub Copilot and Visual Studio Code Remote Code Execution Vulnerability
Exploitation Less Likely
GitHub Copilot and Visual Studio Code Security Feature Bypass Vulnerability
Exploitation Less Likely
GitHub Copilot and Visual Studio Elevation of Privilege Vulnerability
Exploitation Less Likely
GitHub Copilot and Visual Studio Remote Code Execution Vulnerability
Exploitation Less Likely
Desktop Window Manager Elevation of Privilege Vulnerability
Exploitation Detected
GDI+ Denial of Service Vulnerability
Exploitation Less Likely
Mailslot File System Elevation of Privilege Vulnerability
Exploitation More Likely
Microsoft Exchange Server Spoofing Vulnerability
Exploitation Less Likely
MSHTML Framework Security Feature Bypass Vulnerability
Exploitation Detected
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
Exploitation Unlikely
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
Exploitation More Likely
Windows Connected Devices Platform Service Elevation of Privilege Vulnerability
Exploitation Unlikely
Windows Graphics Component Elevation of Privilege Vulnerability
Exploitation Unlikely
Windows Graphics Component Elevation of Privilege Vulnerability
Exploitation Less Likely
Windows HTTP.sys Elevation of Privilege Vulnerability
Exploitation Less Likely
Windows Hyper-V Remote Code Execution Vulnerability
Exploitation Less Likely
Windows Hyper-V Remote Code Execution Vulnerability
Exploitation Less Likely
Windows Hyper-V Remote Code Execution Vulnerability
Exploitation Less Likely
Windows Hyper-V Security Feature Bypass Vulnerability
Exploitation Less Likely
Windows Kernel Elevation of Privilege Vulnerability
Exploitation Less Likely
Windows Kernel Elevation of Privilege Vulnerability
Exploitation More Likely
Windows Kernel Information Disclosure Vulnerability
Exploitation Less Likely
Windows NTLM Spoofing Vulnerability
Exploitation Less Likely
Windows Remote Access Connection Manager Denial of Service Vulnerability
Exploitation Detected
Windows Remote Desktop Services Elevation of Privilege Vulnerability
Exploitation Detected
Windows Shell Security Feature Bypass Vulnerability
Exploitation Detected
Windows Storage Elevation of Privilege Vulnerability
Exploitation Less Likely
Windows Subsystem for Linux Elevation of Privilege Vulnerability
Exploitation Less Likely
Windows Subsystem for Linux Elevation of Privilege Vulnerability
Exploitation Less Likely
Microsoft Excel Elevation of Privilege Vulnerability
Exploitation Less Likely
Microsoft Excel Information Disclosure Vulnerability
Exploitation Less Likely
Microsoft Excel Information Disclosure Vulnerability
Exploitation Less Likely
Microsoft Outlook Spoofing Vulnerability
Exploitation Unlikely
Microsoft Outlook Spoofing Vulnerability
Exploitation More Likely
Microsoft Word Security Feature Bypass Vulnerability
Exploitation Detected
GitHub Copilot for Jetbrains Remote Code Execution Vulnerability
Exploitation Less Likely
Microsoft Exchange Server Spoofing Vulnerability
Exploitation Less Likely
Power BI Remote Code Execution Vulnerability
Exploitation Unlikely
Microsoft Defender for Endpoint Linux Extension Remote Code Execution Vulnerability
Exploitation Less Likely
Cluster Client Failover (CCF) Elevation of Privilege Vulnerability
Exploitation Unlikely
Desktop Window Manager Elevation of Privilege Vulnerability
Exploitation Detected
GDI+ Denial of Service Vulnerability
Exploitation Less Likely
Mailslot File System Elevation of Privilege Vulnerability
Exploitation More Likely
MSHTML Framework Security Feature Bypass Vulnerability
Exploitation Detected
Red Hat, Inc. CVE-2023-2804: Heap Based Overflow libjpeg-turbo
Exploitation Less Likely
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
Exploitation Unlikely
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
Exploitation More Likely
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
Exploitation More Likely
Windows App for Mac Installer Elevation of Privilege Vulnerability
Exploitation Less Likely
Windows Connected Devices Platform Service Elevation of Privilege Vulnerability
Exploitation Unlikely
Windows Graphics Component Elevation of Privilege Vulnerability
Exploitation Unlikely
Windows Graphics Component Elevation of Privilege Vulnerability
Exploitation Less Likely
Windows HTTP.sys Elevation of Privilege Vulnerability
Exploitation Unlikely
Windows HTTP.sys Elevation of Privilege Vulnerability
Exploitation Less Likely
Windows HTTP.sys Elevation of Privilege Vulnerability
Exploitation Less Likely
Windows Hyper-V Remote Code Execution Vulnerability
Exploitation Less Likely
Windows Hyper-V Remote Code Execution Vulnerability
Exploitation Less Likely
Windows Hyper-V Remote Code Execution Vulnerability
Exploitation Less Likely
Windows Hyper-V Security Feature Bypass Vulnerability
Exploitation Less Likely
Windows Kernel Elevation of Privilege Vulnerability
Exploitation Less Likely
Windows Kernel Elevation of Privilege Vulnerability
Exploitation Less Likely
Windows Kernel Elevation of Privilege Vulnerability
Exploitation More Likely
Windows Kernel Information Disclosure Vulnerability
Exploitation Less Likely
Windows Lightweight Directory Access Protocol (LDAP) Denial of Service Vulnerability
Exploitation Unlikely
Windows NTLM Spoofing Vulnerability
Exploitation Less Likely
Windows Remote Access Connection Manager Denial of Service Vulnerability
Exploitation Detected
Windows Remote Desktop Services Elevation of Privilege Vulnerability
Exploitation Detected
Windows Shell Security Feature Bypass Vulnerability
Exploitation Detected
Windows Storage Elevation of Privilege Vulnerability
Exploitation Less Likely
Windows Subsystem for Linux Elevation of Privilege Vulnerability
Exploitation Less Likely
Windows Subsystem for Linux Elevation of Privilege Vulnerability
Exploitation Less Likely
Desktop Window Manager Elevation of Privilege Vulnerability
Exploitation Detected
Microsoft Word Security Feature Bypass Vulnerability
Exploitation Detected
MSHTML Framework Security Feature Bypass Vulnerability
Exploitation Detected
Windows Remote Access Connection Manager Denial of Service Vulnerability
Exploitation Detected
Windows Remote Desktop Services Elevation of Privilege Vulnerability
Exploitation Detected
Windows Shell Security Feature Bypass Vulnerability
Exploitation Detected
Azure SDK for Python Remote Code Execution Vulnerability
Exploitation Less Likely
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
