Microsoft has released updates addressing over 50 vulnerabilities in its Windows operating systems and applications, including six critical zero-day vulnerabilities.
1. CVE-2026-21510: A security feature bypass in Windows Shell that allows execution of malicious content via a single click on a link, affecting all supported Windows versions.
2. CVE-2026-21513: Targets MSHTML, the web browser engine in Windows.
3. CVE-2026-21514: A security feature bypass in Microsoft Word.
4. CVE-2026-21533: Allows local attackers to gain SYSTEM level access in Windows Remote Desktop Services.
5. CVE-2026-21519: An elevation of privilege flaw in the Desktop Window Manager (DWM).
6. CVE-2026-21525: A potential denial-of-service threat in the Windows Remote Access Connection Manager.
Additionally, the updates include fixes for remote code execution vulnerabilities affecting GitHub Copilot and various IDEs, specifically CVE-2026-21516, CVE-2026-21523, and CVE-2026-21256, which arise from a command injection flaw. Security experts emphasize the importance of safeguarding developers due to their access to sensitive data and recommend applying least-privilege principles.