February 2026 Third-Party Vulnerabilities and Patches 

February saw a clear jump in activity compared to January. We tracked 160 unique vulnerabilities across 68 applications, and remediation efforts resulted in 142 version updates. Both findings and patch volume increased notably month over month, making February one of the more active periods since last October. 

Notable vulnerabilities in February 2026 third-party patches 

February saw several high‑risk vulnerabilities, but four zero‑day issues clearly stood out and required the most attention. 

CVE‑2025‑55182 was the most severe, with a CVSS score of 10.0, active exploitation, and a publicly available exploit. Its elevated EPSS score (0.64814) further indicated a high likelihood of real‑world abuse, making it a critical priority. The vulnerability affects React Server Components. The flaw allows an attacker to execute arbitrary code by sending crafted HTTP payloads to exposed React Server Function endpoints, without requiring authentication or user interaction. Due to its CVSS 10.0 severity and remote exploitability, affected applications should be patched immediately following vendor guidance. In addition, public proofs-of-concept (POC) are now widely available, and public security research has identified threat actor exploitation attempts, including reported China-linked threat actors.  
 
The reason why CVE‑2025‑55182 is mentioned in this blog is that not all the vendors had patched the vulnerability even though it was made public March 12, 2025. From the Application Workspace catalog this vulnerability affected Coder by Coder Technologies, Inc. across multiple platforms and package formats. Impacted versions include Coder Mainline on Windows, as well as Coder for Linux (Mainline). More information can be found on GitHub and more generally about the vulnerability on CISA KEV. 

CVE–2026–2441 is a high‑severity zero‑day vulnerability affecting Google Chrome, with a CVSS score of 8.8. Google has confirmed that vulnerability was actively exploited in the wild prior to the release of a patch, and that a working exploit exists. The flaw is a use‑after‑free vulnerability in Chrome’s CSS engine, which can be triggered when a user visits a specially crafted malicious webpage. Successful exploitation allows a remote attacker to execute arbitrary code inside the browser’s sandbox, without requiring authentication or additional user interaction beyond visiting the page. More information can be found on Chrome Releases and on CISA KEV. 

CVE–2026–21514 is a critical zero‑day vulnerability in Microsoft Word, with a CVSS score of 7.8. Microsoft has confirmed that vulnerability has been actively exploited in the wild. The flaw is categorized as a security feature bypass, caused by Microsoft Word relying on untrusted inputs when making security decisions. This allows attackers to circumvent protections that are intended to warn or block malicious content in Word documents. Exploitation requires user interaction, typically by convincing a victim to open a specially crafted Word document delivered via phishing or other social‑engineering techniques. More information can be found on MSRC and CISA KEV. 

CVE–2026–21509 is a another zero‑day in Microsoft Office that stood out this month due to its severity and real‑world exploitation. With a CVSS score of 7.8, the issue has already been abused in active attacks. Exploitation requires social engineering. Victims are persuaded to open a malicious Office document, typically delivered via phishing. Once the file is opened, it can slip past normal security prompts and provide attackers with a foothold for subsequent malicious activity. More information can be found on MSRC and CISA KEV. 

Alongside these, several other critical vulnerabilities with high CVSS scores (including multiple browser and platform components) were disclosed during the month. While they are not zero‑days, they remain important and should be addressed promptly through standard patch management processes.  

• CVE-2026-2778 (Firefox and Thunderbird) 
• CVE-2026-2776 (Firefox and Thunderbird) 
• CVE-2026-2768 (Firefox and Thunderbird) 
• CVE-2025-68121 (Go Language in GitHub) 
• CVE-2026-2760 (Firefox and Thunderbird) 
• CVE-2026-2761 (Firefox and Thunderbird) 

Browser security updates in February 2026 

Major browsers, including Google Chrome, Microsoft Edge, Brave, Mozilla Firefox (including ESR versions), Opera One, Vivaldi, and others received numerous security updates addressing various vulnerabilities.  

Firefox shows a higher number of patched vulnerabilities this month, largely due to Mozilla releasing bundled security updates across multiple supported branches, including ESR versions. Many of these fixes address the same underlying issues and reflect Mozilla’s transparent disclosure and long‑term support model rather than increased risk. 

Microsoft product updates included in February 2026 third-party patches 

Microsoft issued security updates for several other products: 

• Microsoft .NET Runtime 10.0 
• Microsoft .NET Runtime 8.0 
• Microsoft .NET Runtime 9.0 
• Microsoft .NET SDK 10.0 
• Microsoft .NET SDK 8.0 
• Microsoft .NET SDK 9.0 
• Microsoft 365 Apps 
• Microsoft ASP.NET Core Runtime 10.0 
• Microsoft ASP.NET Core Runtime 8.0 
• Microsoft ASP.NET Core Runtime 9.0 
• Microsoft ASP.NET Core Runtime Hosting Bundle 10.0 
• Microsoft ASP.NET Core Runtime Hosting Bundle 8.0 
• Microsoft ASP.NET Core Runtime Hosting Bundle 9.0 
• Microsoft Azure CLI 
• Microsoft Edge Beta 
• Microsoft Edge for Business 
• Microsoft Project 
• Microsoft Visio 
• Microsoft Visual Studio 2022 Community 
• Microsoft Visual Studio 2022 Enterprise 
• Microsoft Visual Studio 2022 Professional 
• Microsoft Visual Studio Code 
• Microsoft Visual Studio Team Explorer 2022 
• Microsoft Windows Desktop Runtime 10.0 
• Microsoft Windows Desktop Runtime 8.0 
• Microsoft Windows Desktop Runtime 9.0 

Detailed list of February 2026 third-party patches 

For a complete list of applications, versions, and the number of remediated vulnerabilities, see the table below generated using Application Workspace data. 

Application management at the speed of your operations 

Vulnerabilities move fast, especially in a distributed workforce. Discover how Recast’s application management product, Application Workspace, helps IT teams keep applications patched, compliant, and correctly configured, wherever work happens.