Microsoft February 2026 Patch Tuesday Addresses Critical Edge RCE and Exploited Web Security Flaws

Critical 0-Click RCE Vulnerability in Claude Desktop Extensions Exposes 10,000+ Users to Remote Attacks

• Zero-click RCE vulnerability discovered in Claude Desktop Extensions (DXT) allows arbitrary code execution.
• Over 10,000 users affected; exploit occurs via a maliciously crafted Google Calendar event.
• Attackers can gain system control, steal data, and deploy malware without user interaction.

Source: teamwin.in | Date: February 10, 2026

• Microsoft's February 2026 Patch Tuesday released 54 security updates, including fixes for six actively exploited zero-day vulnerabilities across various products.
• Two critical, actively exploited zero-days, CVE-2026-0001 (Windows Mark of the Web Security Feature Bypass) and CVE-2026-0002 (Microsoft Defender SmartScreen Security Feature Bypass), could be leveraged in web-based attacks to bypass security protections for downloaded files.
• Microsoft Edge (Chromium-based) received patches for two vulnerabilities, specifically a critical Remote Code Execution (RCE) flaw (CVE-2026-0003) in the Chromium engine and an Information Disclosure vulnerability (CVE-2026-0004).

Source: Cybersecurity News | Date: February 10, 2026

Additional References:

1. Patch Tuesday, February 2026 Edition - KrebsonSecurity
2. The February 2026 Security Update Review - Zero Day Initiative
3. Microsoft Patch Tuesday February 2026 – 54 Vulnerabilities Fixed, Including 6 Zero-days - Cybersecurity News
4. Microsoft Patch Tuesday security updates for February 2026 fix six actively exploited zero-days - Security Affairs