Patch Tuesday, February 2026 Version – Krebs on Safety

Microsoft in the present day launched updates to repair greater than 50 safety holes in its Home windows working programs and different software program, together with patches for a whopping six “zero-day” vulnerabilities that attackers are already exploiting within the wild.

Zero-day #1 this month is CVE-2026-21510, a safety function bypass vulnerability in Home windows Shell whereby a single click on on a malicious hyperlink can quietly bypass Home windows protections and run attacker-controlled content material with out warning or consent dialogs. CVE-2026-21510 impacts all at the moment supported variations of Home windows.

The zero-day flaw CVE-2026-21513 is a safety bypass bug concentrating on MSHTML, the proprietary engine of the default Net browser in Home windows. CVE-2026-21514 is a associated safety function bypass in Microsoft Phrase.

The zero-day CVE-2026-21533 permits native attackers to raise their consumer privileges to “SYSTEM” degree entry in Home windows Distant Desktop Companies. CVE-2026-21519 is a zero-day elevation of privilege flaw within the Desktop Window Supervisor (DWM), a key part of Home windows that organizes home windows on a consumer’s display screen. Microsoft fastened a distinct zero-day in DWM just last month.

The sixth zero-day is CVE-2026-21525, a probably disruptive denial-of-service vulnerability within the Home windows Distant Entry Connection Supervisor, the service chargeable for sustaining VPN connections to company networks.

Chris Goettl at Ivanti reminds us Microsoft has issued a number of out-of-band safety updates since January’s Patch Tuesday. On January 17, Microsoft pushed a repair that resolved a credential immediate failure when trying distant desktop or distant utility connections. On January 26, Microsoft patched a zero-day safety function bypass vulnerability (CVE-2026-21509) in Microsoft Workplace.

Kev Breen at Immersive notes that this month’s Patch Tuesday contains a number of fixes for distant code execution vulnerabilities affecting GitHub Copilot and a number of built-in improvement environments (IDEs), together with VS Code, Visible Studio, and JetBrains merchandise. The related CVEs are CVE-2026-21516, CVE-2026-21523, and CVE-2026-21256.

Breen mentioned the AI vulnerabilities Microsoft patched this month stem from a command injection flaw that may be triggered by immediate injection, or tricking the AI agent into doing one thing it shouldn’t — like executing malicious code or instructions.

“Builders are high-value targets for menace actors, as they typically have entry to delicate knowledge reminiscent of API keys and secrets and techniques that operate as keys to essential infrastructure, together with privileged AWS or Azure API keys,” Breen mentioned. “When organizations allow builders and automation pipelines to make use of LLMs and agentic AI, a malicious immediate can have important influence. This doesn’t imply organizations ought to cease utilizing AI. It does imply builders ought to perceive the dangers, groups ought to clearly establish which programs and workflows have entry to AI brokers, and least-privilege rules ought to be utilized to restrict the blast radius if developer secrets and techniques are compromised.”

The SANS Web Storm Middle has a clickable breakdown of every particular person repair this month from Microsoft, listed by severity and CVSS rating. Enterprise Home windows admins concerned in testing patches earlier than rolling them out ought to keep watch over askwoody.com, which frequently has the thin on wonky updates. Please don’t neglect to again up your knowledge if it has been some time because you’ve accomplished that, and be at liberty to hold forth within the feedback should you expertise issues putting in any of those fixes.