Microsoft Addresses Critical Vulnerabilities in February 2026 Patch Tuesday

On February 7, 2026, Microsoft released a significant set of updates aimed at addressing over 50 security vulnerabilities across its Windows operating systems and other software. Among these, six vulnerabilities were classified as “zero-day,” indicating they are actively being exploited by attackers in the wild. Notable vulnerabilities include CVE-2026-21510, which affects all supported versions of Windows, and CVE-2026-21513, a security bypass bug targeting the MSHTML engine used in the default Windows web browser.

Krebs on Security

The six zero-day vulnerabilities patched this month include:

Krebs on Security

• CVE-2026-21510: Affects all currently supported versions of Windows.

Krebs on Security

• CVE-2026-21513: A security bypass bug in MSHTML.

Krebs on Security

• CVE-2026-21514: A related security feature bypass in Microsoft Word.

Krebs on Security

• CVE-2026-21533: Allows local attackers to elevate privileges to “SYSTEM” level access in Windows Remote Desktop Services.

Krebs on Security

• CVE-2026-21519: An elevation of privilege flaw in the Desktop Window Manager (DWM).

Krebs on Security

• CVE-2026-21525: A denial-of-service vulnerability in the Windows Remote Access Connection Manager, which manages VPN connections.

Krebs on Security

Chris Goettl from Ivanti noted that Microsoft has issued several out-of-band security updates since January, including a fix for a credential prompt failure and a patch for another zero-day vulnerability in Microsoft Office.

Krebs on Security

This month's updates also addressed vulnerabilities related to AI tools, specifically affecting GitHub Copilot and various integrated development environments (IDEs) such as Visual Studio and JetBrains products. The vulnerabilities, identified as CVE-2026-21516, CVE-2026-21523, and CVE-2026-21256, stem from a command injection flaw that can be exploited through malicious prompt injections. Kev Breen from Immersive emphasized that developers are high-value targets for threat actors due to their access to sensitive data, including API keys that are critical for infrastructure security.

Krebs on Security

Microsoft's updates highlight the importance of understanding the risks associated with AI in development environments. Organizations are encouraged to implement least-privilege principles to minimize potential damage if developer secrets are compromised. Additionally, enterprise Windows administrators are advised to monitor resources like askwoody.com for insights on patch testing and updates.

Krebs on Security

While the updates are necessary, some experts caution that organizations should not abandon AI usage. Instead, they should enhance their understanding of the associated risks and ensure robust security measures are in place.

Krebs on Security

• “Developers are high-value targets for threat actors, as they often have access to sensitive data such as API keys and secrets that function as keys to critical infrastructure, including privileged AWS or Azure API keys,” — Kev Breen, Immersive

Krebs on Security

This comprehensive update from Microsoft underscores the ongoing challenges in cybersecurity, particularly as organizations increasingly integrate AI into their workflows.

Krebs on Security