Welcome to my February 2026 Patch Tuesday newsletter. It's an interesting month. We have fewer updates this month with 54 released and an additional 16 in the past 30 days for a total of only 70 updates for the month. Now we do have a higher number of zero days; 6 released today and one on January 29th. So, let's look at our zero days first:

• Public and Exploitation Detected
  • CVE-2026-21510 - To successfully exploit this vulnerability, a user must open a malicious link or shortcut file. This security feature bypass affects all support versions of Windows OS's and although rated "Important" it does have a CVSS of 8.2.
  • CVE-2026-21513 - Protection mechanism failure in MSHTML Framework allows an unauthorized attacker to bypass a security feature over a network. You will need to apply the update to remediate this risk.
  • CVE-2026-24514 - This security feature bypass affects various flavors of Microsoft Office. It does require an attacker to send a user a malicious Office file and convincing the user to open it. Here is yet another reminder for end user education.
• Exploitation Detected but Not Public
  • CVE-2026-21519 - This elevation of privilege vulnerability could give an attacker SYSTEM privileges and affects all supported versions of Windows OS's.
  • CVE-2026-21525 - This moderate rated denial of service also affects Windows OS's. You will want to update when you can even though the CVSS score is just 5.4.
  • CVE-2026-21533 - Improper privilege management in Remote Desktop could allow an attacker to elevate privileges. Microsoft rates this "Important" so update after testing.
• Not Public but Exploitation Detected
  • CVE-2026-21509 - This security feature bypass vulnerability affects Office 2016 and 2019 including LTSC and also MS 365 Apps for Enterprise. Customers running MS 365 Apps and/or Office 2021 or later will be automatically protect via a server-side change and a local restart of the affected applications. If your organization requires a long testing time before applying the update then you may want to click the CVE link above and look at applying a couple of registry key changes to mitigate the issue until you can get the update installed.

I did something a little different in the chart below for this month since we have so many zero-days that are both public and exploited publicly. I've added these twice in yellow and red font to make it clear that they stand out.

Besides these it was a fairly average month. Please view the chart below for more information. I want to invite you to a couple of webinars I'm hosting this month. Both subjects are below. Just click on the title to register. You won't want to miss these.

• AD Certificate Services: A Massive Chunk of Windows Security Functionality Finally Gets the Security Research It Deserves
• Linux Security: Locking Down Admin Access with SSH and Sudo

Happy patching!

So, without further ado, here’s the chart of MS patches that affect Windows platforms in the past month.

Patch data provided by:
Technology	Products Affected	Severity	Reference	Workaround/ Exploited / Publicly Disclosed	Vulnerability Info
Windows	Windows 10, 11 Server 2012, 2012 R2, 2016, 2019, 2022, 2025 including Server Core Installations Windows App for Mac	Important	CVE-2026-20846 CVE-2026-21222 CVE-2026-21231 CVE-2026-21232 CVE-2026-21234 CVE-2026-21235 CVE-2026-21236 CVE-2026-21237 CVE-2026-21238 CVE-2026-21239 CVE-2026-21240 CVE-2026-21241 CVE-2026-21242 CVE-2026-21243 CVE-2026-21244 CVE-2026-21245 CVE-2026-21246 CVE-2026-21247 CVE-2026-21248 CVE-2026-21249 CVE-2026-21250 CVE-2026-21251 CVE-2026-21253 CVE-2026-21255 CVE-2026-21508 CVE-2026-21510** CVE-2026-21510* CVE-2026-21513** CVE-2026-21513* CVE-2026-21517 CVE-2026-21519* CVE-2026-21525* CVE-2026-21533*	Workaround: No Exploited: Yes* Public: Yes**	Denial of Service Elevation of Privilege Information Disclosure Remote Code Execution Security Feature Bypass Spoofing
Edge	Edge (Chromium-based)	Moderate	CVE-2026-0391 CVE-2026-21223	Workaround: No Exploited: No Public: No	Spoofing
Office	365 Apps for Enterprise Copilot Studio Excel, Outlook, Word 2016 Office 2016, 2019 LTSC 2021, 2024 including for Mac Office Online Server	Critical	CVE-2026-21511 CVE-2026-21261 CVE-2026-21514** CVE-2026-21514* CVE-2026-21260 CVE-2026-21258 CVE-2026-21259 CVE-2026-21509* CVE-2026-21520	Workaround: No Exploited: Yes* Public: Yes**	Elevation of Privilege Information Disclosure Security Feature Bypass Spoofing
SharePoint	Enterprise Server 2016 Server 2019 Server Subscription Edition	Important	CVE-2026-21260 CVE-2026-21511	Workaround: No Exploited: No Public: No	Spoofing
Azure	AI Language Authoring, ARC, Data Explorer, DevOps Server 2022, Front Door, Functions, HDInsight, IoT Explorer, Local, Logic Apps, Resource Manager, MS Account, MS ACI Confidential Containers, MS Entra ID, MS Power Apps Desktop Client	Critical	CVE-2026-20960 CVE-2026-21227 CVE-2026-21228 CVE-2026-21264 CVE-2026-21512 CVE-2026-21522 CVE-2026-21524 CVE-2026-21528 CVE-2026-21529 CVE-2026-21531 CVE-2026-21532 CVE-2026-23655 CVE-2026-24300 CVE-2026-24302 CVE-2026-24304 CVE-2026-24305 CVE-2026-24306	Workaround: No Exploited: No Public: No	Elevation of Privilege Information Disclosure Remote Code Execution Spoofing
Developer Tools	GitHub Copilot Plugin for JetBrains IDEs	Important	CVE-2026-21516	Workaround: No Exploited: No Public: No	Remote Code Execution
.NET	10.0, 9.0, 8.0 on Windows, Linux and Mac	Important	CVE-2026-21218	Workaround: No Exploited: No Public: No	Spoofing
Visual Studio	2022 version 18.3, 17.14 Visual Studio Code	Important	CVE-2026-21256 CVE-2026-21257 CVE-2026-21518 CVE-2026-21523	Workaround: No Exploited: No Public: No	Elevation of Privilege Remote Code Execution Security Feature Bypass
SQL Server	Power BI Report Server	Important	CVE-2026-21229	Workaround: No Exploited: No Public: No	Remote Code Execution
Exchange	2016 CU23 2019 CU14 and CU15 Server Subscription Edition RTM	Important	CVE-2026-21527	Workaround: No Exploited: No Public: No	Spoofing
Apps	Windows Notepad 365 Word Copilot 365 Copilot	Critical	CVE-2026-20841 CVE-2026-21521 CVE-2026-24307	Workaround: No Exploited: No Public: No	Information Disclosure Remote Code Execution
System Center	MS Defender for Endpoint for Linux	Important	CVE-2026-21537	Workaround: No Exploited: No Public: No	Remote Code Execution

Thanks as always for reading and best wishes on security,

Randy Franklin Smith

Click here to unsubscribe

Ultimate Windows Security is a division of Monterey Technology Group, Inc. ©2006-2026 Monterey Technology Group, All rights reserved. You may forward this email in its entirety but all other rights reserved.

9450 SW Gemini Drive #53822, Beaverton, OR 97008

Note: We do our best to provide quality information and expert commentary but use all information at your own risk.