Microsoft has rolled out fixes for security vulnerabilities in Windows and Office, which the company says are being actively abused by hackers to break into people’s computers.

The exploits are attack with one clickmeaning that a hacker can plant malware or gain access to a victim’s computer with minimal user interaction. At least two flaws can be exploited by tricking someone into clicking a malicious link on their Windows computer. Another could result in a compromise opening a malicious Office file.

Vulnerabilities are known as zero-daysbecause hackers exploit bugs before Microsoft has time to fix them.

Details of how to exploit the bugs have been published, Microsoft said, which could increase the chance of hacks. Microsoft did not say where they were published, and a Microsoft spokesperson did not immediately comment when reached by TechCrunch. In its bug reports, Microsoft acknowledges the input of Google’s Threat Intelligence Group security researchers in their discovery of the vulnerabilities.

Microsoft said that one of the bugs, officially tracked as CVE-2026-21510found in the Windows shell, which powers the user interface of the operating system. The bug affects all supported versions of Windows, the company said. When a victim clicks on a malicious link from their computer, the bug allows hackers to bypass Microsoft’s SmartScreen feature that normally screens malicious links and files for malware.

According to security expert Dustin Childsthis bug can be abused by remote planting of malware on the victim’s computer.

“There is user interaction here, because the client has to click on a link or a shortcut file,” Childs wrote in his blog post. “However, a one-click bug to get code execution is a rarity.”

A Google spokesperson confirmed that the Windows shell bug is under “widespread, active exploitation,” and said that successful hacks allow the silent execution of malware with elevated privileges, “presenting a high risk of subsequent system compromise, ransomware deployment, or intelligence gathering.”

Another Windows bug, tracked as CVE-2026-21513found in Microsoft’s proprietary browser engine, MSHTML, which powers its legacy and long-discontinued Internet Explorer browser. It can still be found in newer versions of Windows to ensure backward compatibility with older apps.

Microsoft says this bug allows hackers to bypass Windows security features to plant malware.

According to independent security reporter Brian Krebs, Microsoft is also patching three other zero-day bugs of its software that is actively exploited by hackers.