Microsoft Patch Tuesday February 2026: Fixes for 58 vulnerabilities

Microsoft released its February 2026 Patch Tuesday yesterday , fixing a total of 58 vulnerabilities in the Windows ecosystem and its applications. This is one of the most significant updates in recent months, as it includes six zero-day vulnerabilities , that is, bugs that have already been actively exploited by attackers (while three of them were made public before there was an official fix).

This release comes at a time when cyberattacks are on the rise, with ransomware groups and state-backed actors exploiting every available security hole in corporate and personal systems.

Five “Critical” vulnerabilities and dozens of fixes

Microsoft rated five of the vulnerabilities as "Critical", with three related to elevation of privilege and two to disclosure of sensitive information.

See also: Fortinet fixes critical vulnerability that allows code execution

In detail, the corrections are distributed as follows:

• 25 vulnerabilities that allow elevation of privilege
• 12 vulnerabilities that allow remote code execution
• 7 vulnerabilities that allow spoofing
• 6 vulnerabilities that allow information disclosure
• 5 vulnerabilities that allow security features to be bypassed
• 3 vulnerabilities that allow Denial of Service attacks

It is worth noting that three Microsoft Edge vulnerabilities that were patched earlier in the month are not included.

New Secure Boot certificates: End of an era for 2011 keys

Along with the security updates, Microsoft has also begun the gradual replacement of Secure Boot , which expire at the end of June 2026.

According to Windows 11 notes, devices will only receive the new certificates when the system shows sufficient signals of successful update, so that the transition can be done in a safe and controlled manner.

This move is considered critical, as Secure Boot is a key defense mechanism against bootkits and rootkits that attempt to infect the system before the operating system even starts.

See also: BeyondTrust patches critical RCE vulnerability in Remote Support and PRA

February Patch Tuesday: Six zero-day vulnerabilities

The bulk of the update falls on six zero-day vulnerabilities that have already been exploited in real attacks. Microsoft considers a zero-day to be any vulnerability that is either actively exploited or has been publicly disclosed before an official patch is available.

CVE-2026-21510: Windows Shell Security Feature Bypass Vulnerability

This vulnerability allows attackers to bypass Windows SmartScreen security prompts by simply convincing the user to open a malicious link or shortcut file.

"An attacker could bypass Windows SmartScreen and Windows Shell security prompts by exploiting improper handling of Windows Shell components and allowing content to run attacker-controlled," Microsoft continued.

It is likely related to Mark of the Web (MoTW), which have become a key target of phishing campaigns.

CVE-2026-21513: MSHTML Framework Security Feature Bypass Vulnerability

Another serious vulnerability has been identified in the MSHTML Framework, allowing security bypass . Although technical details have not been provided, the fact that it is actively exploited indicates that it is a tool for targeted attacks.

CVE-2026-21514: Microsoft Word Security Feature Bypass Vulnerability

Microsoft also patched a vulnerability in Word that bypasses OLE mitigations in Microsoft 365 and Office. An attacker would need to send a malicious document and convince the user to open it, which remains a classic social engineering tactic.

Microsoft says the flaw cannot be exploited in the Office Preview Pane.

CVE-2026-21519: Desktop Window Manager Elevation of Privilege Vulnerability

This bug allows an attacker to gain SYSTEM privileges, the highest level of access to Windows. It is located in the Desktop Window Manager. Such vulnerabilities are often used after an initial infection to gain complete control of the system.

See also: SmarterMail fixes critical RCE vulnerability

CVE-2026-21525: Windows Remote Access Connection Manager DOS Vulnerability

Microsoft has patched an actively exploited denial of service flaw in Remote Access Connection Manager. The ACROS team and 0patch had identified the exploit as early as December 2025 in a public malware repository, suggesting professional development of attack tools.

CVE-2026-21533: Windows Remote Desktop Services Elevation of Privilege Vulnerability

This vulnerability involves elevation of privilege in Windows Remote Desktop Services.

CrowdStrike has uncovered an exploit that allows threat actors to modify service settings and add a new user to the administrators group. Experts believe that this vulnerability could soon be sold or exploited on a mass scale.

Microsoft Patch Tuesday February 2026: All vulnerabilities

In the table below, you can see all the vulnerabilities being fixed this month:

Source: www.bleepingcomputer.com