Windows Shell Security Feature 0-Day Vulnerability Let Attackers Bypass Authentication

Microsoft issued Patch Tuesday updates addressing CVE-2026-21510, a Windows Shell "Security Feature Bypass" zero-day (CVSS 8.8) actively exploited in the wild; specially crafted shortcut/link files can evade SmartScreen and Mark of the Web checks, enabling immediate execution without user consent—apply February 10, 2026 updates and avoid opening unknown links or shortcut files until patched.