Microsoft Patch Tuesday, February 2026: the CVEs

Microsoft Patch Tuesday February 2026: the CVEs Microsoft published on 10 February 2026, the second Tuesday of the month, with CVSS, EPSS, CISA KEV and public exploits to show what to patch first. Narrow it: in CISA KEV · critical. The same day: Adobe, SAP. Earlier: Jan 2026, Dec 2025, Nov 2025, Oct 2025, Sep 2025, Aug 2025, Jul 2025, Jun 2025, May 2025, Apr 2025, Mar 2025, Feb 2025. Other lists: CISA KEV list, CVE exploit search, Latest critical CVEs, Ransomware CVEs, New CVEs today, This week, Patch Tuesday

1. 7.8CVE-2026-21533KEVEPSS 4.3%2026-02-10

   Improper privilege management in Windows Remote Desktop allows an authorized attacker to elevate privileges locally.

2. 6.2CVE-2026-21525KEVEPSS 5.0%2026-02-10

   Null pointer dereference in Windows Remote Access Connection Manager allows an unauthorized attacker to deny service locally.

3. 7.8CVE-2026-21519KEVEPSS 2.6%2026-02-10

   Access of resource using incompatible type ('type confusion') in Desktop Window Manager allows an authorized attacker to elevate privileges locally.

4. 7.8CVE-2026-21514KEVEPSS 1.6%2026-02-10

   Reliance on untrusted inputs in a security decision in Microsoft Office Word allows an unauthorized attacker to bypass a security feature locally.

5. 8.8CVE-2026-21513KEVEPSS 16%2026-02-10

   Protection mechanism failure in MSHTML Framework allows an unauthorized attacker to bypass a security feature over a network.

6. 8.8CVE-2026-21510KEVEPSS 61%2026-02-10

   Protection mechanism failure in Windows Shell allows an unauthorized attacker to bypass a security feature over a network.