Patch Tuesday, February 2026 Edition
Summary: Microsoft released updates fixing more than 50 security holes in Windows and other software, including patches for six zero-day vulnerabilities attackers are already exploiting in the wild. The zero-days include CVE-2026-21510, a Windows Shell bypass where one click on a malicious link runs attacker-controlled content without warning, and CVE-2026-21533, which lets local attackers elevate to SYSTEM in Windows Remote Desktop Services.
What's compelling: Six zero-days already under active exploitation in a single month means the patch window is not a maintenance task but an active exposure clock. Among them, CVE-2026-21525 is a denial-of-service flaw in the Windows Remote Access Connection Manager, the service that maintains VPN connections to corporate networks.