February 2026 Patch Tuesday: Six Zero-Days Among 59 CVEs

February 2026 Patch Tuesday (TL-2026-0064) is a critical-severity software vulnerability, first published 2026-02-12. It has no confirmed attribution, references 11 CVEs (CVE-2026-21533, CVE-2026-21513, CVE-2026-21510), maps to 25 MITRE ATT&CK techniques (T1003, T1005, T1021), and is covered by 9 detection rules and 38 indicators of compromise.

Key facts for TL-2026-0064

Threat ID
TL-2026-0064
Severity
CRITICAL
Status
PATCHED
Category
VULNERABILITY
First published
2026-02-12
Last reviewed
2026-02-12
Attribution confidence
NONE
Motivation
UNKNOWN
Target sectors
All Sectors — Windows is ubiquitous
Target regions
Global, United States, Canada (CVE-2026-21533 targeting confirmed)
Detection rules
9
Indicators of compromise
38

Microsoft's February 2026 Patch Tuesday addresses 59 vulnerabilities including six actively exploited zero-days, three of which were publicly disclosed before patching. The zero-days span Windows Remote Desktop Services (CVE-2026-21533, EoP, CVSS 7.8 — discovered by CrowdStrike, exploited since December 2025), MSHTML Framework (CVE-2026-21513, SFB, CVSS 8.8 — security prompt bypass via malicious HTML/LNK), Windows Shell (CVE-2026-21510, SFB, CVSS 8.8 — SmartScreen bypass), Microsoft Word (CVE-2026-21514, SFB, CVSS 7.8 — OLE mitigation bypass), Desktop Window Manager (CVE-2026-21519, EoP, CVSS 7.8 — type confusion to SYSTEM), and Windows Remote Access Connection Manager (CVE-2026-21525, DoS, CVSS 6.2 — null pointer dereference). Three of these zero-days (CVE-2026-21513, CVE-2026-21510, CVE-2026-21514) form a security feature bypass cluster that collectively undermines Windows' defense-in-depth: SmartScreen, Shell security prompts, and Office OLE mitigations are all bypassable, enabling attackers to deliver malware through social engineering without triggering any security warnings. Additionally, five Critical vulnerabilities affect Azure services (Front Door CVSS 9.8, Arc CVSS 8.6, Functions CVSS 8.2) and ACI Confidential Containers (EoP CVSS 6.7, InfoDisc CVSS 6.5). The Azure vulnerabilities were remediated server-side by Microsoft requiring no customer action.

How February 2026 Patch Tuesday works

February 2026 Patch Tuesday: Six Zero-Days Among 59 CVEs — Complete Analysis

Patch Tuesday Overview: - Total CVEs: 59 - Actively Exploited Zero-Days: 6 - Publicly Disclosed (before patch): 3 of the 6 zero-days - Critical Severity: 5 - Important Severity: 53 - Moderate Severity: 1 - Risk Types: Elevation of Privilege 25 (42%), Remote Code Execution 12 (20%), Spoofing 8 (14%) - Most Patched Product: Windows (32 patches), ESU (25 patches)

=== THE SIX ZERO-DAYS ===

1. CVE-2026-21533 — Windows Remote Desktop Services Elevation of Privilege - CVSS: 7.8 (Important) - Status: Actively exploited, NOT publicly disclosed - Discovery: CrowdStrike identified and reported to Microsoft - Exploitation: Modifies service configuration key, replacing with attacker-controlled key → escalate to Administrator group - Active Since: December 24, 2025 (at minimum) — targeting US and Canada-based entities - CrowdStrike Assessment: Public disclosure will 'almost certainly' encourage broader exploitation by threat actors possessing exploit binaries and exploit brokers - Attack Vector: Local, Low complexity, Low privilege required, No user interaction - Impact: High to Confidentiality, Integrity, Availability - CrowdStrike Intel: CSA-260174 - PATCH URGENCY: CRITICAL — actively exploited for 7+ weeks before patch

2. CVE-2026-21513 — MSHTML Framework Security Feature Bypass - CVSS: 8.8 (Important) - Status: Actively exploited AND publicly disclosed - Exploitation: Remote attackers bypass security prompts when executing files via malicious HTML or .lnk shortcut files. Manipulates browser and Windows Shell handling — content executes without security warnings. - Attack Vector: Network, Low complexity, No privileges required, Requires user interaction - Impact: High to Confidentiality, Integrity, Availability - Affected: Windows 10, Windows 11, Windows Server 2012+ - Social Engineering: Delivered via phishing emails with HTML attachments or malicious shortcut files - PATCH URGENCY: CRITICAL — publicly disclosed + actively exploited + low complexity

3. CVE-2026-21510 — Windows Shell Security Feature Bypass - CVSS: 8.8 (Important) - Status: Actively exploited AND publicly disclosed - Exploitation: Bypasses Windows SmartScreen and Windows Shell security prompts. Malicious links or shortcut files execute without user warning or consent. - Attack Vector: Network, Low complexity, No privileges required, Requires user interaction - Impact: High to Confidentiality, Integrity, Availability - Technique: Exploits improper handling in Windows Shell components - Social Engineering: Readily exploitable through phishing and social engineering - PATCH URGENCY: CRITICAL — SmartScreen is a critical defense layer; bypass enables unopposed malware delivery

4. CVE-2026-21514 — Microsoft Word Security Feature Bypass - CVSS: 7.8 (Important) - Status: Actively exploited AND publicly disclosed - Exploitation: Bypasses OLE (Object Linking and Embedding) mitigations in Microsoft 365 and Office. Malicious Office files execute vulnerable COM/OLE controls without protection. - Attack Vector: Local, Low complexity, No privileges required, Requires user interaction - Impact: High to Confidentiality, Integrity, Availability - NOT via Preview Pane: Requires user to open the file - Social Engineering: Phishing emails with malicious Word attachments - PATCH URGENCY: HIGH — OLE bypass enables macro-style attacks without macro warnings

5. CVE-2026-21519 — Desktop Window Manager Elevation of Privilege - CVSS: 7.8 (Important) - Status: Actively exploited, NOT publicly disclosed - Exploitation: Type confusion in Desktop Window Manager (dwm.exe). Local attacker with low privileges escalates to SYSTEM. - Attack Vector: Local, Low complexity, Low privilege required, No user interaction - Impact: High to Confidentiality, Integrity, Availability - Note: No proven public exploit code, but active exploitation detected — threat actors possess working exploits - DWM runs as SYSTEM — compromise = full system control - PATCH URGENCY: CRITICAL — SYSTEM-level escalation with no user interaction required

6. CVE-2026-21525 — Windows Remote Access Connection Manager Denial of Service - CVSS: 6.2 (Moderate) - Status: Actively exploited, NOT publicly disclosed - Exploitation: Null pointer dereference causes denial of service in RASMAN - Attack Vector: Local, Low complexity, No privileges required, No user interaction - Impact: High to Availability only - Note: Lowest severity of the six zero-days; DoS only (no code execution) - PATCH URGENCY: MODERATE — availability impact only, no privilege escalation

=== FIVE CRITICAL AZURE VULNERABILITIES ===

7. CVE-2026-24300 — Azure Front Door EoP (CVSS 9.8) - Improper access control. Remote, no auth, no interaction. HIGHEST CVSS this month. - Remediated server-side by Microsoft — no customer action required.

8. CVE-2026-24302 — Azure Arc EoP (CVSS 8.6) - Improper access control with changed scope. Remote, no auth. - Remediated server-side — no customer action required.

9. CVE-2026-21532 — Azure Function Information Disclosure (CVSS 8.2) - Sensitive information exposure. Remote, no auth. - Remediated server-side — no customer action required.

10. CVE-2026-21522 — ACI Confidential Containers EoP (CVSS 6.7) - Command injection in Azure Compute Gallery. Local, high privileges required. - PoC exists. Official fix available — customer must deploy.

11. CVE-2026-23655 — ACI Confidential Containers InfoDisc (CVSS 6.5) - Cleartext storage of sensitive information. Remote, low privileges. - Official fix available — customer must deploy.

=== STRATEGIC ANALYSIS ===

The Security Feature Bypass Cluster (CVE-2026-21513 + CVE-2026-21510 + CVE-2026-21514): These three zero-days form a coordinated threat to Windows defense-in-depth: - CVE-2026-21513 bypasses MSHTML security prompts - CVE-2026-21510 bypasses SmartScreen and Shell security - CVE-2026-21514 bypasses Office OLE mitigations Together, they neutralize the three primary security gates that protect users from social engineering attacks. An attacker can deliver malicious content via HTML, shortcut files, or Office documents — and NONE of them will trigger security warnings. This is the most dangerous cluster because it turns every phishing email into a reliable initial access vector.

The Privilege Escalation Chain (CVE-2026-21533 + CVE-2026-21519): Two zero-days that escalate from low-privilege to SYSTEM/Administrator: - CVE-2026-21533 adds attacker to Administrator group via RDS service key manipulation - CVE-2026-21519 escalates to SYSTEM via DWM type confusion Combined with any of the security bypass zero-days for initial access, an attacker has a complete kill chain: bypass security warnings → gain initial access → escalate to SYSTEM → full compromise. All with actively exploited zero-days.

MITRE ATT&CK techniques used in TL-2026-0064

credential-access

T1003 OS Credential Dumping

collection

T1005 Data from Local System

lateral-movement

T1021 Remote Services

defense-evasion

T1027 Obfuscated Files or Information; T1078 Valid Accounts; T1134 Access Token Manipulation; T1218 System Binary Proxy Execution

execution

T1059 Command and Scripting Interpreter; T1106 Native API; T1203 Exploitation for Client Execution; T1204 User Execution; T1559 Inter-Process Communication

privilege-escalation

T1068 Exploitation for Privilege Escalation

discovery

T1082 System Information Discovery; T1518 Software Discovery

persistence

T1098 Account Manipulation; T1136 Create Account; T1543 Create or Modify System Process; T1547 Boot or Logon Autostart Execution

defense-impairment

T1112 Modify Registry; T1553 Subvert Trust Controls; T1685 Disable or Modify Tools

impact

T1486 Data Encrypted for Impact; T1499 Endpoint Denial of Service

initial-access

T1566 Phishing

Remediation for February 2026 Patch Tuesday

Patches

  • February 2026 Patch Tuesday — KB articles pending per Windows version
  • Microsoft 365 Apps — auto-updated via Microsoft Update
  • Azure ACI Confidential Containers — official fix available, manual deployment required
  • Azure Front Door, Arc, Functions — no action required (server-side fix applied)

Immediate actions

  • PATCH IMMEDIATELY: Deploy February 2026 Patch Tuesday updates for all six zero-days — all are actively exploited in the wild
  • PRIORITY 1: CVE-2026-21533 (RDS EoP) — exploited since December 2025 against US/Canada entities. Patch RDS servers first.
  • PRIORITY 2: Security bypass cluster (CVE-2026-21513, CVE-2026-21510, CVE-2026-21514) — these three combined neutralize SmartScreen, Shell prompts, and Office OLE protections. Patch all endpoints.
  • PRIORITY 3: CVE-2026-21519 (DWM EoP to SYSTEM) — no user interaction required, low complexity. Any local attacker gets SYSTEM.
  • Block .lnk and .html attachments in email gateways as interim mitigation until patches deployed — CVE-2026-21513 and CVE-2026-21510 exploited via these file types

Workarounds

  • CVE-2026-21513/21510: Block HTML and LNK attachments at email gateway; restrict web-based content delivery to sandboxed environments
  • CVE-2026-21514: Disable OLE/COM automation in Office via Group Policy (restrictive — may break business workflows)
  • CVE-2026-21533: Restrict Remote Desktop access to authorized administrators only; monitor for unauthorized service configuration changes
  • CVE-2026-21519: No workaround — DWM cannot be disabled. Patch is the only mitigation.
  • General: Enable Credential Guard, configure ASR rules, deploy EDR with behavioral detection for privilege escalation patterns

Longer-term hardening

  • Implement automated patch deployment within 24 hours for actively exploited zero-days — 7-week exploitation window for CVE-2026-21533 is unacceptable
  • Deploy application control (AppLocker/WDAC) to limit execution of content delivered via security bypass vulnerabilities
  • Enable Attack Surface Reduction (ASR) rules in Microsoft Defender: Block Office child processes, Block execution of potentially obfuscated scripts, Block Win32 API calls from Office macros
  • Deploy Conditional Access policies requiring compliant/patched devices for access to sensitive resources
  • Implement network segmentation to limit lateral movement after privilege escalation via CVE-2026-21533 or CVE-2026-21519
  • For Azure: Deploy ACI Confidential Container patches (CVE-2026-21522, CVE-2026-23655) — these require customer action unlike the other Azure fixes

CVEs associated with February 2026 Patch Tuesday

CVE-2026-21533, CVE-2026-21513, CVE-2026-21510, CVE-2026-21514, CVE-2026-21519, CVE-2026-21525, CVE-2026-24300, CVE-2026-24302, CVE-2026-21532, CVE-2026-21522, CVE-2026-23655

Weaknesses (CWE) in February 2026 Patch Tuesday

CWE-843, CWE-79, CWE-476, CWE-284, CWE-200, CWE-77, CWE-312

Timeline of February 2026 Patch Tuesday

  • CVE-2026-21533 exploitation begins in the wild targeting US and Canada-based entities. CrowdStrike Intelligence retrospective hunting identifies exploit binaries modifying Windows Remote Desktop service configuration keys. Exploitation predates Microsoft's patch by approximately 7 weeks. Source: CrowdStrike CSA-260174.
  • January 2026 Patch Tuesday released. CVE-2026-21533 is NOT addressed — exploitation continues unpatched through January. The 7-week exploitation window demonstrates the critical importance of rapid patch cycles and interim mitigation for zero-days discovered by security vendors.
  • Three Critical Azure vulnerabilities (CVE-2026-24300 CVSS 9.8, CVE-2026-24302 CVSS 8.6, CVE-2026-21532 CVSS 8.2) remediated server-side by Microsoft. No customer action required. Published for transparency. Azure Front Door, Arc, and Functions customers automatically protected.
  • CrowdStrike publishes 'February 2026 Patch Tuesday: Updates and Analysis' detailing all 6 zero-days and 5 Critical vulnerabilities. CrowdStrike identified and reported CVE-2026-21533 (RDS EoP) to Microsoft. CrowdStrike Intelligence assesses public disclosure will 'almost certainly' encourage broader exploitation. Source: CrowdStrike blog.
  • Microsoft releases February 2026 Patch Tuesday: 59 CVEs total, 6 actively exploited zero-days (3 publicly disclosed), 5 Critical. CrowdStrike publishes detailed analysis. The three publicly disclosed zero-days (CVE-2026-21513, CVE-2026-21510, CVE-2026-21514) form a security feature bypass cluster targeting MSHTML, Shell/SmartScreen, and Office OLE protections.
  • Threadlinqs analysis: Three security feature bypass zero-days (CVE-2026-21513, CVE-2026-21510, CVE-2026-21514) collectively neutralize Windows defense-in-depth for social engineering attacks. SmartScreen + Shell prompts + OLE mitigations are the three gates protecting users from malicious content — all three are now bypassable. Combined with two privilege escalation zero-days (CVE-2026-21533, CVE-2026-21519), attackers have a complete kill chain: bypass security warnings → initial access → SYSTEM. Every hour of delayed patching is an hour of exposure to six simultaneously exploited zero-days.
  • Organizations begin deploying February 2026 Patch Tuesday updates. The 24-48 hour window after patch release is critical — threat actors reverse-engineer patches to develop exploits for the newly disclosed (but not yet patched) vulnerabilities. Organizations that delay patching beyond 48 hours face exponentially increasing risk.
  • As of 2026-05-29, all six Feb 2026 Patch Tuesday zero-days (incl. CVE-2026-21533) plus the five Azure CVEs are fully patched (released Feb 10-11) and were added to CISA KEV with a March 3 deadline now passed. Vendor reporting confirms no new unpatched variant or successor advisory; residual risk is only un-patched hosts, with an exploit broker offering CVE-2026-21533 for sale (Blackswan, Mar 10).

Sources cited for February 2026 Patch Tuesday

Threats related to February 2026 Patch Tuesday

Detection coverage for TL-2026-0064

As of 2026-02-12, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0064 across Splunk SPL, Microsoft KQL and Sigma, covering 38 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats