Microsoft Patch Tuesday — February 2026

Exploited 6

Confirmed exploited (CISA KEV, ENISA). "Zero-day" means exploitation was known by the patch day — install these first.

• High 8.8
  CVE-2026-21510 Zero-day Public exploit Windows Shell Security Feature Bypass Vulnerability
  EPSS 61%
• High 8.8
  CVE-2026-21513 Zero-day MSHTML Framework Security Feature Bypass Vulnerability
  EPSS 16%
• High 7.8
  CVE-2026-21514 Zero-day Public exploit Microsoft Word Security Feature Bypass Vulnerability
  EPSS 1.6%
• High 7.8
  CVE-2026-21533 Zero-day Public exploit Windows Remote Desktop Services Elevation of Privilege Vulnerability
  EPSS 4.3%
• High 7.8
  CVE-2026-21519 Zero-day Desktop Window Manager Elevation of Privilege Vulnerability
  EPSS 2.6%
• Medium 6.2
  CVE-2026-21525 Zero-day Windows Remote Access Connection Manager Denial of Service Vulnerability
  EPSS 5%

Critical 1

• Critical 9.8
  CVE-2026-21531 Public exploit Azure SDK for Python Remote Code Execution Vulnerability
  EPSS 2.5%

All vulnerabilities 54