Windows zero-days exploited in 2026: what was attacked and what to do

Publicly disclosed: February – October 2026

2026 has been a record year for the number of vulnerabilities Microsoft fixes each month, and several Windows flaws were exploited in real attacks. Most of them share a pattern: a malicious file arrives by email or messenger, and Windows protections that should warn the user — such as Mark of the Web — are bypassed, or the file leaks the user's NTLM password hash.

Protections that work against the whole class

1. Install Patch Tuesday updates quickly — several of these flaws were exploited within days.
2. Block or quarantine risky attachment types (archives with shortcuts, .lnk, .url, .iso, .vhd) at the email gateway.
3. Restrict outgoing NTLM and SMB traffic to the internet (port 445) so leaked hashes cannot be sent out, and enable SMB signing.
4. Use Attack Surface Reduction rules and endpoint protection that watches behaviour, not only signatures.
5. Train staff: an unexpected file is a reason to ask, not to click.

Most Windows zero-days still need one click. Patching closes the hole; awareness removes the click.

Sources: SecurityWeek, October 2026, BleepingComputer, April 2026, CISA KEV catalog.

Need help with this? Contact CySec for a free consultation.

All articles