Patch Tuesday, February 2026
Microsoft's monthly security release, Tuesday, February 10, 2026. Includes CVEs published within two days either side; Adobe and SAP ride the same day.
7 CVEs · 1 critical · 7 exploited · 2 with public exploit code
Microsoft only. Adobe and SAP are below. Exploited first, then public exploit code, then highest CVSS.
Microsoft
7 CVEs · 1 critical · 7 exploited · 2 with public exploit code
- 9.8CriticalFeb 12, 2026Microsoft Configuration Manager SQL injectionCVE-2024-43468Microsoft Configuration Manager contains an SQL injection vulnerability. An unauthenticated attacker could exploit this vulnerability by sending specially crafted requests to the target environment which are processed in an unsafe manner enabling the attacker to execute commands on the server and/or underlying database.Exploited81% likelyExploit codeDetection
- 8.8HighFeb 10, 2026Microsoft WindowsCVE-2026-21510Windows Shell, specifically Windows Explorer and Windows Search, are affected. An attacker gains arbitrary code execution with elevated privileges. Patch Windows to the latest version and restrict access to sensitive directories.Exploited25% likelyExploit code
- 8.8HighFeb 10, 2026Microsoft WindowsCVE-2026-21513Microsoft MSHTML Framework contains a protection mechanism failure vulnerability that could allow an unauthorized attacker to bypass a security feature over a network.Exploited16% likely
- 7.8HighFeb 10, 2026Microsoft OfficeCVE-2026-21514Microsoft Office Word contains a reliance on untrusted inputs in a security decision vulnerability that could allow an authorized attacker to elevate privileges locally.Exploited1.6% likely
- 7.8HighFeb 10, 2026Microsoft Windows Memory corruptionCVE-2026-21519Microsoft Desktop Windows Manager contains a type confusion vulnerability that could allow an authorized attacker to elevate privileges locally.Exploited2.5% likely
- 7.8HighFeb 10, 2026Microsoft Windows Privilege escalationCVE-2026-21533Microsoft Windows Remote Desktop Services contains an improper privilege management vulnerability that could allow an authorized attacker to elevate privileges locally.Exploited4.1% likely
- 6.2MediumFeb 10, 2026Microsoft Windows Memory corruptionCVE-2026-21525Microsoft Windows Remote Access Connection Manager contains a NULL pointer dereference that could allow an unauthorized attacker to deny service locally.Exploited4.8% likely
Adobe
No tracked Adobe CVEs in this window.
SAP
No tracked SAP CVEs in this window.
The release date follows Microsoft's usual schedule (second Tuesday). Chips show what Watch Floor knows: CISA KEV listing, public exploit code and published detection rules.