Microsoft says hackers are exploiting critical zero-day bugs to target Windows and Office users

Microsoft has released fixes for security vulnerabilities in Windows and Office that the company says are being actively exploited The exploits function as one click attacks with minimal user interaction required. At least two flaws can be triggered One vulnerability, tracked as CVE-2026-21510, resides in the Windows shell and affects all supported versions of Windows. The flaw lets attackers Google confirmed the Windows shell bug is under widespread active exploitation. Attacks permit the silent execution of malware with high privileges and carry a high risk of system compromise, ransomware deployment, or intelligence collection. A separate bug, tracked as CVE-2026-21513, is located in the MSHTML browser engine. It enables attackers to