AISEC > Security News > Zero Day > Microsoft Patch Tuesday Feb 2026: 6 Zero-Days Exploited
February 10, 2026 #zero-day Source: Krebs on Security 2 min read · 538 words

Patch Tuesday, February 2026 Edition

Patch Tuesday, лютого 2026 року

Microsoft's February 2026 Patch Tuesday Just Got Real Serious

Six zero-day vulnerabilities. All actively being exploited. All just patched by Microsoft.

That's not hyperbole. That's not a worst-case scenario someone dreamed up. According to Krebs on Security, Microsoft released security patches for over 50 vulnerabilities across Windows and other software this month, and six of them—six—were already under active attack before the patches dropped.

When was the last time you saw that kind of number?

Breaking It Down

Here's what makes this Patch Tuesday different from the usual Tuesday routine. Most vulnerability patches address bugs that researchers found, responsibly disclosed, and gave Microsoft time to fix. Those are bad enough. But zero-days? Those are exploits that attackers discovered first and have been weaponizing against users while vendors scramble to catch up.

The fact that six of them were already in the wild means attackers had a head start. They were already inside networks, already stealing data, already pivoting toward critical systems.

And then Microsoft patched them all at once.

The broader patch bundle—covering 50+ vulnerabilities total—spans Windows operating systems and other Microsoft products. This isn't just a Windows problem, though Windows definitely takes the hit. You're looking at enterprise software, cloud services, the whole ecosystem that millions of organizations depend on.

The Technical Side

Without diving into full CVE disclosures that aren't yet fully public, the mechanics here matter. Zero-days typically exploit either logical flaws in how software handles input, memory corruption vulnerabilities, or privilege escalation pathways that let attackers run code they shouldn't be able to run.

The reason six of them made it to active exploitation before being patched? That tells us attackers had either sophisticated reconnaissance capabilities or were targeting specific high-value organizations. Sometimes both.

This is particularly nasty because the time window between discovery and patch is when damage happens. Attackers aren't spraying these exploits randomly. They're surgical. They're going after financial institutions, government networks, critical infrastructure.

Who's Affected

Honestly? Potentially everyone running unpatched Microsoft software.

If you're on Windows—any version currently supported—you need to assume you're in scope. If you're running Microsoft 365, Azure, Exchange Server, SharePoint, or any of their enterprise applications, same deal. Organizations that haven't patched since January? They've got a serious problem.

The real question is: how many attackers already got in before today?

Forensics teams across the security industry are probably running incident response investigations right now, trying to figure out who got compromised through these zero-days over the past weeks or months. That's going to take time. That's going to hurt.

What To Do Now

First: patch. Today. Not this week. Today.

If you're running Windows or any Microsoft product that received updates in February 2026, download and install them immediately. Don't wait for your change management process to catch up. Don't schedule it for next month. These weren't theoretical vulnerabilities—attackers were literally using them.

Second: check your logs. If you've got access to security monitoring or SIEM data, look for suspicious activity in the timeframe before the patch release. Unusual privilege escalation attempts. Unexpected lateral movement. Network connections to unfamiliar IPs.

Third: assume compromise is possible. Even if you patched quickly, someone might've gotten in already. Consider engaging incident response, at least for a preliminary assessment of your critical systems.

Fourth: stop trusting that Patch Tuesday is optional. This is what happens when you treat updates like a suggestion.

Read original article →

// FAQ

Should I apply Microsoft's February 2026 patches immediately?

Yes, absolutely. Six of the 50+ vulnerabilities patched are zero-days actively being exploited. Install these updates today, not next week, especially if you're running Windows or Microsoft enterprise applications.

How do I know if my organization was already compromised by these zero-days?

Check your security logs and SIEM data for suspicious activity (privilege escalation, lateral movement, unusual connections) dating back several weeks before the patch release. Consider engaging incident response for critical systems assessment if your organization was unpatched during the exploitation window.

Which Microsoft products are affected by the February 2026 zero-days?

The patches cover Windows operating systems and other Microsoft software across their product ecosystem. Specific CVE details and affected products are available from Microsoft's official security advisory and Krebs on Security's reporting.

// RELATED

#zero-day CISA warns that RESURGE malware can be dormant on Ivanti devices 2026-02-27 #zero-day US Sanctions Russian Exploit Broker Operation Zero 2026-02-26 #zero-day Cisco SD-WAN Zero-Day Under Exploitation for 3 Years 2026-02-26

Concerned about your project's security? Run an automated pentest with AISEC — AI-powered scanner with expert verification. Go to dashboard →