Background and Timeline: On February 10, 2026, Microsoft released its monthly “Patch Tuesday” updates, addressing 60 vulnerabilities across Windows and Office. Among these, six vulnerabilities were identified as actively being exploited in the wild at the time of the release. This release is documented as the most critical update cycle for Windows-based networks in the first quarter of the year.

Modus Operandi: Three of the zero-day flaws involve security feature bypasses that allow attackers to deliver malware at scale. For example, CVE-2026-21510 is a failure in the Windows Shell that allows an unauthorized attacker to bypass Windows SmartScreen prompts. An attacker can convince a user to click a malicious link or.lnk file, causing attacker-controlled content to execute without consent or warning.

Victims and Financial Impact: The vulnerabilities affect all supported versions of Windows, including both client and server editions, putting millions of enterprise systems at immediate risk. Because the Windows Shell is universally used, these flaws materially increase the effectiveness of global phishing and ransomware campaigns. Failure to patch these flaws allows adversaries to move laterally across enterprise hybrid environments.

Investigation and Agencies Involved: Action1 and Fortra security researchers assisted Microsoft in identifying the active exploitation of these weaknesses. The Cybersecurity & Infrastructure Security Agency (CISA) has updated its Known Exploited Vulnerabilities (KEV) catalog, mandating that U.S. federal agencies remediate these specific flaws immediately. The Sequential nature of some CVE numbers suggests they were discovered during a single, wide-ranging forensic investigation.

Arrests and Suspects: No specific threat actors have been named yet, though “Confirmed active exploitation” points to advanced persistent threat (APT) groups using these bypasses for initial access. Russian and Chinese-aligned actors have historically weaponized similar Office and Shell bugs within days of public disclosure. Security firms are monitoring for the deployment of “ZeroDayRAT,” a new mobile spyware that utilizes these bypasses to target both Android and iOS.

Broader Implications and Trends: This update cycle highlights the increasing vulnerability of “trusted system components” like Windows Shell and LNK files. It demonstrates that adversaries are focusing on bypassing security prompts (SmartScreen) rather than breaking encryption directly. The ease of exploit—requiring only a single user click—underscores the critical need for automated patching in the 2026 enterprise landscape.