Patch Tuesday February 2026: what's exploited and what to install first
Microsoft released fixes for 54 vulnerabilities on Feb 10, 2026. 6 are already being exploited by attackers, so install those fixes first. 2 are rated Critical.
Install these first: already exploited
- Desktop Window ManagerExploitedImportantCVSS 7.8Desktop Window Manager Elevation of Privilege Vulnerability
What to do: Install this month's Microsoft updates and restart. Attackers are already using this flaw.
- Windows Remote DesktopExploitedImportantCVSS 7.8Windows Remote Desktop Services Elevation of Privilege Vulnerability
What to do: Install this month's Microsoft updates and restart. Attackers are already using this flaw.
- MSHTML FrameworkExploitedImportantCVSS 8.8MSHTML Framework Security Feature Bypass Vulnerability
What to do: Install this month's Microsoft updates and restart. Attackers are already using this flaw.
- Windows ShellExploitedImportantCVSS 8.8Windows Shell Security Feature Bypass Vulnerability
What to do: Install this month's Microsoft updates and restart. Attackers are already using this flaw.
- Microsoft Office WordExploitedImportantCVSS 7.8Microsoft Word Security Feature Bypass Vulnerability
What to do: Install this month's Microsoft updates and restart. Attackers are already using this flaw.
- Windows Remote Access Connection ManagerExploitedModerateCVSS 6.2Windows Remote Access Connection Manager Denial of Service Vulnerability
What to do: Install this month's Microsoft updates and restart. Attackers are already using this flaw.
Critical fixes
- CVSS 6.7 Microsoft ACI Confidential Containers Elevation of Privilege Vulnerability
- CVSS 6.5 Microsoft ACI Confidential Containers Information Disclosure Vulnerability
How to install this month's updates
- Windows PCs: Settings → Windows Update → Check for updates, install, and restart. Restarting is what actually applies the fix.
- Managed fleets: approve this month's updates in Intune, Windows Update for Business or WSUS, and push the exploited fixes first instead of waiting for your normal ring schedule.
- Microsoft 365 Apps / Office: usually updates itself; in any Office app, File → Account → Update Options → Update Now to make sure.
- Servers: Exchange, SharePoint and SQL Server need their own update packages; they don't come through Windows Update alone.
- Check it worked: confirm the build number afterwards (run
winver) or check with our version checker.
By type
| Type | Fixes |
|---|---|
| Elevation of Privilege | 23 |
| Remote Code Execution | 11 |
| Spoofing | 7 |
| Information Disclosure | 5 |
| Security Feature Bypass | 5 |
| Denial of Service | 3 |
Most-patched products
| Product | Fixes |
|---|---|
| Role: Windows Hyper-V | 4 |
| Windows Kernel | 4 |
| Microsoft Office Excel | 3 |
| Windows Ancillary Function Driver for WinSock | 3 |
| GitHub Copilot and Visual Studio | 3 |
| Windows HTTP.sys | 3 |
| Microsoft Office Outlook | 2 |
| Windows Subsystem for Linux | 2 |
The next Patch Tuesday is Nov 10, 2026 (in 5 days). Microsoft usually publishes around 10 a.m. Pacific; this page updates within the hour.
Questions
What should I patch first from Patch Tuesday February 2026?
The 6 exploited flaws: Desktop Window Manager Elevation of Privilege Vulnerability; Windows Remote Desktop Services Elevation of Privilege Vulnerability; MSHTML Framework Security Feature Bypass Vulnerability; Windows Shell Security Feature Bypass Vulnerability; Microsoft Word Security Feature Bypass Vulnerability; Windows Remote Access Connection Manager Denial of Service Vulnerability. Attackers are already using them.
When is the next Patch Tuesday?
Nov 10, 2026. Microsoft releases security updates on the second Tuesday of every month.
Source: Microsoft's February 2026 release notes and CISA's exploited-vulnerability catalog. Counts exclude Chromium fixes shipped in Microsoft Edge. Microsoft last revised this release on Nov 4, 2026. General information only; confirm details with Microsoft.