AISEC > Security News > Zero Day > Microsoft Patch Tuesday February 2026: 6 Zero-Days Exploited
February 10, 2026 #zero-day Source: Krebs on Security 3 min read · 733 words

Patch Tuesday, February 2026 Edition

Patch Tuesday, лютий 2026: видання

Microsoft's February Patch Tuesday Just Got Real: Six Zero-Days Already Under Attack

Six zero-day vulnerabilities. Actively being exploited. Right now.

That's what Microsoft dropped on us this week, buried inside a patch release for over 50 total vulnerabilities across Windows and related software. According to Krebs on Security, this isn't theoretical—these aren't vulnerabilities that might someday be weaponized. They're being actively exploited in the wild, which means attackers have already figured out how to abuse them and are doing so as we speak.

If you've been watching the Microsoft cyber attack news cycle over the past couple of years, you've probably noticed the frequency of these incidents keeps climbing. We saw serious activity in July 2024, then more disruptions throughout 2025. But this February update represents something particularly nasty because it's not a zero-day that was discovered and responsibly disclosed—these were found out the hard way, through actual compromise attempts.

Breaking It Down

Let's be clear about what we're dealing with here. Out of 50+ vulnerabilities patched in this Patch Tuesday release, six of them had zero days before Microsoft even knew about them. That means attackers found exploitable weaknesses, developed working attacks, and deployed them in real environments before the company had any chance to prepare a fix.

Frankly, this should have been caught sooner.

The scope is broad. We're talking Windows systems across multiple versions, plus other Microsoft products that run everywhere from corporate data centers to small business networks. And here's what makes it worse: the gap between when the vulnerability existed and when patches became available represents a window where anyone could've been compromised. Some organizations might still be vulnerable if they haven't applied these updates yet.

This follows a troubling pattern. The Microsoft cyber attack landscape has shifted dramatically. In July 2024, we saw major incidents that exposed the company's patch management challenges. Throughout 2025, that didn't improve much. Now we're in 2026 with six active zero-days, which suggests either the threat actors are getting smarter or Microsoft's internal security processes need a serious overhaul—possibly both.

The Technical Side

Without diving into specifics that could help the wrong people, zero-day exploits work because they target code paths that were never tested under adversarial conditions. Microsoft's developers wrote the code thinking about legitimate use cases. Attackers thought about breaking it in ways nobody anticipated.

Once a zero-day is discovered through active exploitation, reversing it becomes urgent but complicated. Researchers have to figure out exactly what the attacker was doing, validate that it actually works, build a fix, test it across every supported platform, and release it—all while making sure the patch doesn't break anything else. That's what happened here. The fact that we got 50+ patches in one release suggests Microsoft's teams have been working overtime.

But the real question is: how many other organizations are still patching? Patch Tuesday issues aren't just about availability—they're about deployment speed. Even after patches exist, there's usually a lag before systems get updated, especially in environments with change management processes or legacy software.

Who's Affected

Potentially everyone running Windows or Microsoft-adjacent software. We're talking enterprises, government agencies, small businesses, nonprofits. If you've got a device running Windows, you should assume you're in scope until proven otherwise.

The six zero-days that were actively exploited likely affected specific targets initially—probably high-value organizations that attackers were specifically trying to compromise. But that's almost irrelevant now. Once the attack code exists and researchers start documenting the vulnerabilities (which they will), the threat expands exponentially. Vulnerability brokers will analyze these. Exploit databases will be updated. By next week, less-sophisticated attackers will have working tools.

What To Do Now

Install these patches immediately. Not this week. Not when you have a maintenance window. Today, if possible.

If you're managing systems for other people—IT team, managed service provider, whatever your role is—this is your priority. Queue up the Windows updates, test them in a non-critical environment first if you must, then deploy. The risk of running unpatched systems right now exceeds the risk of a bad patch in this case.

For individual users, check Windows Update settings. Make sure automatic updates are enabled. Restart your system if prompted. Yes, it's inconvenient. Six zero-days being actively exploited is more inconvenient.

And if you're tracking patch Tuesday vulnerability numbers as part of security monitoring—congrats, you've got your work cut out for you. Document which systems you've patched. Track which ones are still pending. That forensic trail matters if you need to investigate whether you were compromised before the patches were available.

Read original article →

// FAQ

Should I apply the Microsoft patches immediately or wait for stability reports?

Apply them immediately. Six zero-days are actively being exploited right now, which means the risk of staying unpatched far outweighs the small chance of patch-related issues. Test in non-critical environments first if needed, but deploy ASAP.

What are the CVE numbers for these six zero-day vulnerabilities?

CVE numbers weren't specified in the initial Krebs on Security report. Check Microsoft's official security updates page or CVSS databases for the complete list of CVE identifiers and severity ratings for all 50+ vulnerabilities.

Could my organization have been compromised before these patches were released?

Possibly. If you weren't already patched, there's a window where these zero-days could have been exploited. Review logs and audit trails for suspicious activity, and consider running security scans on affected systems to detect potential compromise.

// RELATED

#zero-day APT28 Tied to CVE-2026-21513 MSHTML 0-Day Exploited Before Feb 2026 Patch Tuesday 2026-03-02 #zero-day CISA warns that RESURGE malware can be dormant on Ivanti devices 2026-02-27 #zero-day US Sanctions Russian Exploit Broker Operation Zero 2026-02-26

Concerned about your project's security? Run an automated pentest with AISEC — fully automated AI-powered scanner. Go to dashboard →