Microsoft deployed a comprehensive security update addressing more than 50 vulnerabilities spanning its Windows platforms and broader software ecosystem. The release is notable for tackling six zero-day flaws currently being weaponized by attackers in real-world campaigns.

The Six Zero-Day Vulnerabilities

The first critical flaw, CVE-2026-21510, represents a bypass in Windows Shell security mechanisms. Through a single malicious link click, attackers can circumvent Windows protections and execute their code without triggering user warnings or consent prompts. This vulnerability impacts every supported Windows version.

CVE-2026-21513 targets MSHTML, the rendering engine powering Windows' integrated browser, while CVE-2026-21514 represents a parallel security bypass affecting Microsoft Word.

Two additional zero-days enable privilege escalation on Windows systems. CVE-2026-21533 permits local attackers to gain SYSTEM-level access through Windows Remote Desktop Services, whereas CVE-2026-21519 affects the Desktop Window Manager (DWM), the component managing window display. Microsoft patched a separate DWM zero-day just one month prior.

The final zero-day, CVE-2026-21525, introduces a denial-of-service risk in the Windows Remote Access Connection Manager, which handles VPN connectivity to enterprise networks.

Recent Out-of-Band Updates

Chris Goettl at Ivanti highlighted that Microsoft has deployed multiple emergency patches since January's monthly release cycle. On January 17, the company issued a fix addressing credential prompt failures during remote desktop and remote application sessions. A subsequent January 26 update resolved CVE-2026-21509, a zero-day security bypass in Microsoft Office.

AI Development Tools Under Attack

This month's update includes patches for remote code execution flaws impacting AI-assisted development platforms. Kev Breen at Immersive identified fixes for GitHub Copilot and multiple integrated development environments, including VS Code, Visual Studio, and JetBrains offerings. The affected vulnerabilities are catalogued as CVE-2026-21516, CVE-2026-21523, and CVE-2026-21256.

According to Breen, these AI-related vulnerabilities stem from command injection weaknesses exploitable through prompt injection—a technique where attackers manipulate AI systems into executing unauthorized operations or malicious instructions.

Developers are high-value targets for threat actors, as they often have access to sensitive data such as API keys and secrets that function as keys to critical infrastructure, including privileged AWS or Azure API keys. When organizations enable developers and automation pipelines to use LLMs and agentic AI, a malicious prompt can have significant impact. This does not mean organizations should stop using AI. It does mean developers should understand the risks, teams should clearly identify which systems and workflows have access to AI agents, and least-privilege principles should be applied to limit the blast radius if developer secrets are compromised.

Kev Breen, Immersive

Guidance for Administrators

The SANS Internet Storm Center maintains a searchable index of each Microsoft fix, sortable by severity rating and CVSS score. Windows administrators planning staged deployments should monitor askwoody.com for reports of problematic updates. Organizations should ensure current backups exist before applying patches and report any installation difficulties encountered.

Source: Krebs on Security