Roundup of Microsoft Patch Tuesday (February 2026)

Summary

On February 11 (UTC+8), 2026, Microsoft released its February 2026 Security Updates, which included patches for a total of 61 CVEs, a decrease of 54 CVEs compared to the previous month.

In terms of vulnerability severity, there were 5 vulnerabilities marked as "Critical" and 54 vulnerabilities marked as "Important/High". In terms of vulnerability types, there were primarily 14 remote code execution vulnerabilities, 25 privilege escalation vulnerabilities, and 6 information disclosure vulnerabilities.

Statistics

Vulnerability Trend

Figure 1 Vulnerabilities Patched by Microsoft in the Last 12 Months

• On the whole, Microsoft released 61 patches in February 2026, including 5 critical vulnerability patches.
• Based on Microsoft's historical vulnerability disclosures and the specific circumstances of this year, Sangfor FarSight Labs estimates that Microsoft will announce a similar quantity of vulnerabilities in the coming March in comparison to February. We expect a figure of approximately 60 vulnerabilities.

Comparison of Vulnerability Trends

The following figure shows the number of patches released by Microsoft in the month of February from 2023 to 2026.

Figure 2 Number of Windows Patches Released by Microsoft in February from 2023 to 2026

The following figure shows the trend and number of vulnerabilities at different severity levels addressed by Microsoft in February from 2023 to 2026.

Figure 3 Number of Vulnerabilities by Severity Level Addressed by Microsoft in February from 2023 to 2026

The following figure shows the number of vulnerabilities by type addressed by Microsoft in February from 2023 to 2026.

Figure 4 Number of Vulnerabilities by Type Addressed by Microsoft in February from 2023 to 2026

Data source: Microsoft security updates

• Compared to last year, there has been a decrease in terms of the number of vulnerabilities this year. The number of vulnerabilities addressed by Microsoft in February 2026 has decreased. A total of 61 vulnerability patches, including 5 critical ones, have been reported this month.
• Compared to last year, the number of vulnerabilities at the Critical level addressed by Microsoft has increased, and that of vulnerabilities at the Important/High level has decreased. Specifically, 5 vulnerabilities at the Critical level have been addressed, an increase of about 25%; and 54 vulnerabilities at the Important/High level have been addressed, a decrease of about 8%.
• In terms of the vulnerability type, both the number of remote code execution (RCE) vulnerabilities and the number of denial-of-service (DoS) vulnerabilities have decreased, whereas the number of elevation of privilege (EoP) vulnerabilities has increased. We should remain highly vigilant because, when combined with social engineering techniques, attackers can exploit RCE vulnerabilities to take over the entire local area network (LAN) and launch attacks.

Details of Key Vulnerabilities

Analysis

Microsoft Word Security Feature Bypass Vulnerability (CVE-2026-21514)

This vulnerability arises because Microsoft Office Word overly relies on untrusted inputs in security decisions, without adequately validating these inputs. Upon successful exploitation, attackers can bypass Microsoft Word's native protection mechanisms to access and manipulate information with elevated privileges. This vulnerability has been actively exploited in the wild.

Windows Shell Security Feature Bypass Vulnerability (CVE-2026-21510)

This vulnerability arises because the protection mechanism of Windows Shell fails to adequately validate relevant network requests. It allows unauthorized attackers to bypass security features over the network. Upon successful exploitation, attackers can access, manipulate, and destroy high-level confidential information. This vulnerability has been actively exploited in the wild.

MSHTML Framework Security Feature Bypass Vulnerability (CVE-2026-21513)

This vulnerability stems from a flaw in the protection mechanism of the MSHTML framework. Successful exploitation enables unauthorized attackers to bypass network security features. This vulnerability has been actively exploited in the wild.

Windows Remote Desktop Services Elevation of Privilege Vulnerability (CVE-2026-21533)

This vulnerability stems from improper privilege management in Windows Remote Desktop. Successful exploitation enables attackers to elevate privileges locally. This vulnerability has been actively exploited in the wild.

Desktop Window Manager Elevation of Privilege Vulnerability (CVE-2026-21519)

Resource access using an incompatible type ("type confusion") in Desktop Window Manager allows an authorized attacker to elevate privileges locally. This vulnerability has been actively exploited in the wild.

Affected Versions

Solutions

Official Solution

Microsoft has released security patches for affected software. Affected users can install the corresponding security patches based on their system versions.

Download links:

1. https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21514
2. https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21510
3. https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21513
4. https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21519
5. https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21533

References

https://msrc.microsoft.com/update-guide/releaseNote/2026-Feb

Timeline

On February 11, 2026, Microsoft released a security bulletin.

On February 11, 2026, Sangfor FarSight Labs released a vulnerability alert.

Learn More

Sangfor FarSight Labs researches the latest cyber threats and unknown zero-day vulnerabilities, alerting customers to potential dangers to their organizations, and providing real-time solutions with actionable intelligence. Sangfor FarSight Labs works with other security vendors and the security community at large to identify and verify global cyber threats, providing fast and easy protection for customers.