Microsoft's security release of 10 February 2026
Patch Tuesday, February 2026
As of , CISA lists six of the 54 CVEs Microsoft published on Patch Tuesday, , as exploited. Patch first: CVE-2026-21510, Windows Shell Security Feature Bypass.
On CISA's list of exploited vulnerabilities
- CVE-2026-21510Windows Shell Security Feature Bypass. Listed by CISA on 10 February 2026, release day
- CVE-2026-21513MSHTML Framework Security Feature Bypass. Listed by CISA on 10 February 2026, release day
- CVE-2026-21525Windows Remote Access Connection Manager Denial of Service. Listed by CISA on 10 February 2026, release day
- CVE-2026-21533Windows Remote Desktop Services Elevation of Privilege. Listed by CISA on 10 February 2026, release day
- CVE-2026-21519Desktop Window Manager Elevation of Privilege. Listed by CISA on 10 February 2026, release day
- CVE-2026-21514Microsoft Word Security Feature Bypass. Listed by CISA on 10 February 2026, release day
The release in numbers
| What | CVEs |
|---|---|
| CVE records Microsoft published | 54 CVEs |
| On CISA's list of exploited vulnerabilities | 6 CVEs |
| CISA's SSVC exploitation: active | 6 CVEs |
| CISA's SSVC exploitation: proof of concept | none |
| CISA's SSVC exploitation: none | 48 CVEs |
| Not assessed by CISA's SSVC | none |
| Critical by CVSS (9.0 or more) | 1 CVE |
| EPSS 0.10 or more | 3 CVEs |
Patch first: the release in our order
| # | Vulnerability | CISA's SSVC exploitation | CISA's list | CVSS | EPSS |
|---|---|---|---|---|---|
| 1 | CVE-2026-21510Windows Shell Security Feature Bypass | Active | Patch soonListed | 8.8 High | 0.25 |
| 2 | CVE-2026-21513MSHTML Framework Security Feature Bypass | Active | Patch soonListed | 8.8 High | 0.16 |
| 3 | CVE-2026-21525Windows Remote Access Connection Manager Denial of Service | Active | Patch soonListed | 6.2 Medium | 0.05 |
| 4 | CVE-2026-21533Windows Remote Desktop Services Elevation of Privilege | Active | Patch soonListed | 7.8 High | 0.04 |
| 5 | CVE-2026-21519Desktop Window Manager Elevation of Privilege | Active | Patch soonListed | 7.8 High | 0.02 |
| 6 | CVE-2026-21514Microsoft Word Security Feature Bypass | Active | Patch soonListed | 7.8 High | 0.02 |
| 7 | CVE-2026-21249Windows NTLM Spoofing | None | Not on CISA's list | 3.3 Low | 0.11 |
| 8 | CVE-2026-20841Windows Notepad App Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.09 |
| 9 | CVE-2026-21527Microsoft Exchange Server Spoofing | None | Not on CISA's list | 6.5 Medium | 0.08 |
| 10 | CVE-2026-21511Microsoft Outlook Spoofing | None | Not on CISA's list | 7.5 High | 0.04 |
| 11 | CVE-2026-21531Azure SDK for Python Remote Code Execution | None | Not on CISA's list | 9.8 Critical | 0.03 |
| 12 | CVE-2026-21231Windows Kernel Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.03 |
| 13 | CVE-2026-21238Windows Ancillary Function Driver for WinSock Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.03 |
| 14 | CVE-2026-21241Windows Ancillary Function Driver for WinSock Elevation of Privilege | None | Not on CISA's list | 7.0 High | 0.03 |
| 15 | CVE-2026-21260Microsoft Outlook Spoofing | None | Not on CISA's list | 7.5 High | 0.02 |
| 16 | CVE-2026-21256GitHub Copilot and Visual Studio Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 17 | CVE-2026-21516GitHub Copilot for Jetbrains Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 18 | CVE-2026-21518GitHub Copilot and Visual Studio Code Security Feature Bypass | None | Not on CISA's list | 8.8 High | 0.01 |
| 19 | CVE-2026-21537Microsoft Defender for Endpoint Linux Extension Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 20 | CVE-2026-21228Azure Local Remote Code Execution | None | Not on CISA's list | 8.1 High | 0.01 |
| 21 | CVE-2026-21229Power BI Remote Code Execution | None | Not on CISA's list | 8.0 High | 0.01 |
| 22 | CVE-2026-21257GitHub Copilot and Visual Studio Elevation of Privilege | None | Not on CISA's list | 8.0 High | 0.01 |
| 23 | CVE-2026-21523GitHub Copilot and Visual Studio Code Remote Code Execution | None | Not on CISA's list | 8.0 High | 0.01 |
| 24 | CVE-2026-21250Windows HTTP.sys Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.01 |
| 25 | CVE-2026-21259Microsoft Excel Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.01 |
| 26 | CVE-2026-20846GDI+ Denial of Service | None | Not on CISA's list | 7.5 High | 0.01 |
| 27 | CVE-2026-21218.NET Spoofing | None | Not on CISA's list | 7.5 High | 0.01 |
| 28 | CVE-2026-21243Windows Lightweight Directory Access Protocol (LDAP) Denial of Service | None | Not on CISA's list | 7.5 High | 0.01 |
| 29 | CVE-2026-21235Windows Graphics Component Elevation of Privilege | None | Not on CISA's list | 7.3 High | 0.01 |
| 30 | CVE-2026-21244Windows Hyper-V Remote Code Execution | None | Not on CISA's list | 7.3 High | 0.01 |
| 31 | CVE-2026-21247Windows Hyper-V Remote Code Execution | None | Not on CISA's list | 7.3 High | 0.01 |
| 32 | CVE-2026-21248Windows Hyper-V Remote Code Execution | None | Not on CISA's list | 7.3 High | 0.01 |
| 33 | CVE-2026-21253Mailslot File System Elevation of Privilege | None | Not on CISA's list | 7.0 High | 0.01 |
| 34 | CVE-2026-21512Azure DevOps Server Cross-Site Scripting | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 35 | CVE-2026-21528Azure IoT Explorer Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 36 | CVE-2026-23655Microsoft ACI Confidential Containers Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 37 | CVE-2026-21529Azure HDInsight Spoofing | None | Not on CISA's list | 5.7 Medium | 0.01 |
| 38 | CVE-2026-21222Windows Kernel Information Disclosure | None | Not on CISA's list | 5.5 Medium | 0.01 |
| 39 | CVE-2026-21258Microsoft Excel Information Disclosure | None | Not on CISA's list | 5.5 Medium | 0.01 |
| 40 | CVE-2026-21261Microsoft Excel Information Disclosure | None | Not on CISA's list | 5.5 Medium | 0.01 |
| 41 | CVE-2026-21255Windows Hyper-V Security Feature Bypass | None | Not on CISA's list | 8.8 High | 0.00 |
| 42 | CVE-2026-21232Windows HTTP.sys Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 43 | CVE-2026-21236Windows Ancillary Function Driver for WinSock Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 44 | CVE-2026-21239Windows Kernel Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 45 | CVE-2026-21240Windows HTTP.sys Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 46 | CVE-2026-21245Windows Kernel Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 47 | CVE-2026-21246Windows Graphics Component Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 48 | CVE-2026-21251Cluster Client Failover (CCF) Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 49 | CVE-2026-21234Windows Connected Devices Platform Service Elevation of Privilege | None | Not on CISA's list | 7.0 High | 0.00 |
| 50 | CVE-2026-21237Windows Subsystem for Linux Elevation of Privilege | None | Not on CISA's list | 7.0 High | 0.00 |
| 51 | CVE-2026-21242Windows Subsystem for Linux Elevation of Privilege | None | Not on CISA's list | 7.0 High | 0.00 |
| 52 | CVE-2026-21508Windows Storage Elevation of Privilege | None | Not on CISA's list | 7.0 High | 0.00 |
| 53 | CVE-2026-21522Microsoft ACI Confidential Containers Elevation of Privilege | None | Not on CISA's list | 6.7 Medium | 0.00 |
| 54 | CVE-2026-21517Windows App for Mac Installer Elevation of Privilege | None | Not on CISA's list | 4.7 Medium | 0.00 |
By impact
What this page counts
The CVE records Microsoft published as a CVE Numbering Authority on 10 February 2026, the second Tuesday of the month. Microsoft's own release notes can also name CVEs other organisations assigned, such as Chromium's for Edge; those are not counted here.
Titles, CVSS scores and impact words are Microsoft's, from the CVE records. The list of exploited vulnerabilities and the SSVC values are CISA's. EPSS is FIRST's daily score. The order is ours: entries on CISA's list first, in our patch-first order, then CISA's SSVC exploitation value, then EPSS, then CVSS.