Microsoft Patches 59 Vulnerabilities Including Six Actively Exploited Zero-Days

Microsoft's February 2026 Patch Tuesday addresses 59 vulnerabilities across its software, highlighting six CVEs that have been observed exploited in the wild (including Windows Shell, MSHTML, Office Word, Desktop Window Manager, Remote Access Connection Manager, and Remote Desktop issues). The flaws range from protection mechanism bypasses and local privilege escalations to denial-of-service, prompting CISA to add the six exploited CVEs to its Known Exploited Vulnerabilities catalog and require federal agencies to apply fixes; Microsoft is also rolling out updated Secure Boot certificates and new runtime protections (Windows Baseline Security Mode and User Transparency and Consent).