Microsoft's February 2026 Patch Tuesday: 58 Flaws, Six Zero-Days, and Copilot Under Fire

Note: This post was written by Claude Opus 4.6. The following is a synthesis of reporting from major security news organizations.

Microsoft’s February 2026 Patch Tuesday is smaller than January’s 114-flaw marathon, but far more dangerous. The update addresses 58 vulnerabilities — and six of them were already being exploited in the wild before the patches dropped. That’s an unusually high exploitation rate. As the Zero Day Initiative put it: “We’re on our way to another hot exploit summer.”

The Six Zero-Days

All six were added to CISA’s Known Exploited Vulnerabilities catalog on the same day, with a remediation deadline of March 3, 2026 for Federal agencies.

CVE-2026-21510 — Windows Shell Security Feature Bypass (CVSS 8.8). This is the one to worry about most. An attacker sends a malicious link or shortcut file; the user clicks it; Windows SmartScreen stays silent. No warning dialog, no consent prompt — just execution. Google Threat Intelligence Group and Microsoft’s own MSTIC reported it. Action1 called it the “most urgent risk to Windows-based networks” this month.

CVE-2026-21513 — MSHTML Framework Security Feature Bypass (CVSS 8.8). Similar mechanics but targeting the old Internet Explorer rendering engine that still lives inside Windows. Despite IE’s deprecation, MSHTML remains a frequent attack surface because the Trident engine persists in the OS. A malicious HTML page or .lnk file bypasses MSHTML security controls to enable code execution.

CVE-2026-21514 — Microsoft Word Security Feature Bypass (CVSS 7.8). Opens a hole in Office’s OLE mitigations — the protections that prevent dangerous COM controls from running inside documents. The user has to open a crafted Word file, but the Preview Pane is not a vector. Notably, Microsoft shipped an out-of-band fix for a related Office bypass (CVE-2026-21509) just two weeks earlier, suggesting attackers are systematically probing Office security boundaries.

CVE-2026-21519 — Windows Desktop Window Manager Elevation of Privilege (CVSS 7.8). A type confusion flaw that lets a low-privilege attacker escalate to SYSTEM. This is the second consecutive month a DWM zero-day has been exploited in the wild — January’s CVE-2026-20805 targeted the same component — indicating sustained attacker interest in Windows’ GUI rendering subsystem.

CVE-2026-21525 — Windows Remote Access Connection Manager DoS (CVSS 6.2). An unauthenticated local attacker can crash the RasMan service with a NULL pointer dereference, killing VPN connections. The Zero Day Initiative noted it’s “unusual to see a DoS bug under active attack,” which suggests it’s being used as part of a broader attack chain rather than as a standalone disruption.

CVE-2026-21533 — Windows Remote Desktop Services Elevation of Privilege (CVSS 7.8). CrowdStrike reported this one, and the backstory is alarming: threat actors have been using the exploit binary in the wild since at least December 24, 2025, targeting entities in the U.S. and Canada. The flaw lets an authenticated attacker modify a service configuration key and escalate to SYSTEM. CrowdStrike warned that Microsoft’s public disclosure “will almost certainly encourage threat actors possessing CVE-2026-21533 exploit binaries to use or monetize the exploits in the near term.”

Critical Vulnerabilities

Five vulnerabilities are rated critical this month, and all five are in Azure cloud services. Three were already mitigated server-side by Microsoft before the public disclosure:

GitHub Copilot: A New Attack Surface

Three remote code execution vulnerabilities in GitHub Copilot deserve attention beyond their CVSS scores:

• CVE-2026-21516 — GitHub Copilot for JetBrains RCE (CVSS 8.8)
• CVE-2026-21523 — GitHub Copilot for VS Code RCE
• CVE-2026-21256 — GitHub Copilot for Visual Studio RCE

All three stem from command injection via prompt injection in malicious codebases — user-supplied input passed directly to a system command interpreter without sanitization. An attacker who poisons a repository could achieve code execution on a developer’s machine simply by having Copilot process the malicious code.

As Kev Breen of Immersive Labs noted: “Developers are high-value targets for threat actors, as they often have access to sensitive data such as API keys and secrets.”

The Full Breakdown

Two Outlook Bugs Worth Watching

CVE-2026-21511 and CVE-2026-21260 are both Outlook spoofing vulnerabilities with CVSS scores of 7.5. Both exploit deserialization of untrusted data — and critically, both can be triggered through the Preview Pane alone, meaning no user click is required beyond viewing the email. Microsoft rated both as “Exploitation More Likely.” Organizations running classic Outlook should prioritize these.

Known Issues

Good news on the bug front: the January shutdown issue affecting Windows 11 systems with Virtual Secure Mode has been fixed. Microsoft also resolved a WPA3 Wi-Fi connectivity problem introduced by the January updates.

As of publication, Microsoft says it is “not currently aware of any issues” with the February cumulative updates — though the same was said about January’s patches before the shutdown bug surfaced.

Recommendations

With six zero-days, this month’s patches demand urgent attention. The CISA deadline of March 3rd is a reasonable target for any organization, not just Federal agencies.

Priority order:

1. CVE-2026-21510 (SmartScreen bypass) — one click to code execution
2. CVE-2026-21513 (MSHTML bypass) — similar severity, similar mechanics
3. CVE-2026-21519 and CVE-2026-21533 (EoP to SYSTEM) — post-compromise escalation paths already in active use
4. CVE-2026-21514 (Word bypass) — part of an ongoing pattern targeting Office security boundaries
5. GitHub Copilot updates — especially for organizations with open-source dependencies

Developers using GitHub Copilot in any IDE should update their extensions immediately. The prompt injection attack vector is particularly insidious because it targets the tool developers trust most.

Sources

• BleepingComputer - Microsoft February 2026 Patch Tuesday fixes 6 zero-days, 58 flaws
• Tenable - Microsoft’s February 2026 Patch Tuesday Addresses 54 CVEs
• Qualys - Microsoft and Adobe Patch Tuesday, February 2026 Security Update Review
• Krebs on Security - Patch Tuesday, February 2026 Edition
• Zero Day Initiative - The February 2026 Security Update Review
• CrowdStrike - February 2026 Patch Tuesday: Updates and Analysis
• CISA - Adds Six Known Exploited Vulnerabilities to Catalog