Vulnerabilitycritical
Patch Tuesday, February 2026 Edition
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-21256 | Improper neutralization of special elements used in a command ('command injection') in GitHub Copilot and Visual Studio allows an unauthorized attacker to… | 8.8 | 1% | ||
| CVE-2026-21509 | Local Security Feature Bypass in Microsoft Office Under Active Exploitation | 7.8 | 71% | KEV | KEV |
CVE-2026-21510+4 related CVEs | Security Feature Bypass in Microsoft Windows Shell Actively Exploited (CVE-2026-21510) | 8.8 group max | 61% | KEV | KEV |
| CVE-2026-21514 | Actively Exploited Security Feature Bypass in Microsoft Word (CVE-2026-21514) | 7.8 | 2% | KEV | KEV |
| CVE-2026-21516 | Improper neutralization of special elements used in a command ('command injection') in Github Copilot allows an unauthorized attacker to execute code over a… | 7.8 | <1% | ||
| CVE-2026-21523 | Time-of-check time-of-use (toctou) race condition in GitHub Copilot and Visual Studio allows an authorized attacker to execute code over a network | 8.0 | <1% |
From the original article
2 min read at krebsonsecurity.comMicrosoft today released updates to fix more than 50 security holes in its Windows operating systems and other software, including patches for a whopping six “zero-day” vulnerabilities that attackers are already exploiting in the wild.
krebsonsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.