Microsoft's February 2026 Patch Tuesday

Microsoft's February 2026 Patch Tuesday with six actively exploited and three publicly disclosed zero-day vulnerabilities.

Microsoft Patch Tuesday

February 2026 Security Updates

Total of 61 Vulnerabilities

  • 25 Elevation of Privilege [EoP]
  • 5 Security Feature Bypass [FB]
  • 12 Remote Code Execution [RCE]
  • 6 Information Disclosure [ID]
  • 3 Denial of Service [DoS]
  • 7 Spoofing
  • 3 Edge - Chromium

6 Exploited In The Wild

Highest Rated Vulnerabilities

5 Vulnerabilities More Likely To Be Exploited

February’s release is a “drop everything” month: Microsoft’s February 2026 security updates include 6 vulnerabilities confirmed as exploited in the wild (i.e., active attacks observed), spanning EoP, Security Feature Bypass, and DoS. Microsoft's full report here.

--The 6 exploited CVEs--

1) CVE-2026-21519 — Desktop Window Manager (DWM) EoP (CVSS 7.8)

  • Why it matters: local authenticated attacker can elevate to SYSTEM (classic post-comp foothold → full takeover).
  • Patch priority: Highest on endpoints and VDI pools; assume it’ll be chained with phishing/RCE elsewhere.

2) CVE-2026-21533 — Windows Remote Desktop Services EoP (CVSS 7.8)

  • Why it matters: EoP in the RDS stack is especially concerning in environments with broad RDP use (jump boxes, admins, shared servers).
  • Patch priority: Highest for anything with RDS/RDP exposure (even if “internal only”).

3) CVE-2026-21513 — MSHTML Framework Security FB (CVSS 8.8)

  • Why it matters: exploitation involves tricking a user into opening a malicious HTML or shortcut (.lnk) file; Microsoft notes this was publicly disclosed and exploited.
  • Patch priority: Immediate on user endpoints (email/Teams download paths, helpdesk machines, shared kiosks).

4) CVE-2026-21510 — Windows Shell Security FB (CVSS 8.8)

  • Why it matters: shell bypass bugs tend to enable execution or weakening of protections by abusing how Windows handles content, files, or trust boundaries.
  • Patch priority: Immediate on endpoints and RDS hosts.

5) CVE-2026-21514 — Microsoft Word Security FB (CVSS 7.8)

  • Why it matters: requires convincing a user to open a crafted Office file; notably, Preview Pane is not an attack vector (still very patch-now).
  • Patch priority: Immediate anywhere Word is installed (workstations, terminal servers).

6) CVE-2026-21525 — Remote Access Connection Manager (RasMan) DoS (CVSS 6.2)

  • Why it matters: “just DoS” sounds tame, but active exploitation suggests it may be used for disruption, defense evasion, or as part of a larger chain. Tenable notes this was exploited and credits 0patch for reporting.
  • Patch priority: Fast on VPN/RAS-heavy fleets, always-on remote workforce endpoints, and servers providing remote access services.

--Patching Game Plan--

Tier 0 [patch within 24–48 hours]

Reason: these map cleanly to common initial-access paths (user interaction / file delivery).

Tier 1 [patch ASAP right after Tier 0]

Reason: strong post-comp escalators; prioritize admin workstations, shared servers, jump hosts, VDI/RDS farms.

Tier 2 [patch quickly, schedule appropriately]

Reason: exploited activity means it’s operationally relevant even if impact class is “DoS.”