Microsoft Patches 6 Actively Exploited Zero-Days in February Security Update

Microsoft's Patch Tuesday tackles six exploited vulnerabilities, including three zero-days in Windows and Office, demanding urgent updates.

By Content Team

Feb 11, 2026

ON THIS PAGE

Microsoft's February Patch Tuesday isn't routine maintenance—it's active defense. Attackers are already exploiting six of the 59 disclosed vulnerabilities, making immediate patching critical.

Three zero-days bypass security features in Windows and Office products. CVE-2026-21510 lets attackers slip past SmartScreen protections, while CVE-2026-21513 affects the MSHTML framework and CVE-2026-21514 targets Word documents. All require user interaction but can execute malicious code without warnings.

Two additional zero-days enable privilege escalation to admin-level access, and another causes denial-of-service attacks. Microsoft even issued an emergency out-of-band patch for a similar Office vulnerability in January.

Security experts warn these bypass vulnerabilities dramatically increase phishing and malware campaign success rates, especially dangerous given the widespread use of affected components like Word and Windows Shell.

Source: Dark Reading

Have questions about protecting your software?

Our escrow experts are standing by to help.

Book a free demo

Want more insights like this?