# February 2026 Patch Tuesday: Six Zero-Days Among 59 CVEs

> Microsoft's February 2026 Patch Tuesday addresses 59 vulnerabilities including six actively exploited zero-days, three of which were publicly disclosed before patching. The zero-days span Windows Remote Desktop Services (CVE-2026-21533, EoP, CVSS 7.8 — discovered by CrowdStrike, exploited since December 2025), MSHTML Framework (CVE-2026-21513, SFB, CVSS 8.8 — security prompt bypass via malicious HTML/LNK), Windows Shell (CVE-2026-21510, SFB, CVSS 8.8 — SmartScreen bypass), Microsoft Word (CVE-2026-21514, SFB, CVSS 7.8 — OLE mitigation bypass), Desktop Window Manager (CVE-2026-21519, EoP, CVSS 7.8 — type confusion to SYSTEM), and Windows Remote Access Connection Manager (CVE-2026-21525, DoS, CVSS 6.2 — null pointer dereference). Three of these zero-days (CVE-2026-21513, CVE-2026-21510, CVE-2026-21514) form a security feature bypass cluster that collectively undermines Windows' defense-in-depth: SmartScreen, Shell security prompts, and Office OLE mitigations are all bypassable, enabling attackers to deliver malware through social engineering without triggering any security warnings. Additionally, five Critical vulnerabilities affect Azure services (Front Door CVSS 9.8, Arc CVSS 8.6, Functions CVSS 8.2) and ACI Confidential Containers (EoP CVSS 6.7, InfoDisc CVSS 6.5). The Azure vulnerabilities were remediated server-side by Microsoft requiring no customer action.

- **Published:** 2026-02-12T04:35:58Z
- **Last reviewed:** 2026-02-12T04:35:58Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0064
- **ID:** TL-2026-0064
- **Severity:** CRITICAL
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 · **IOCs:** 38 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-21533, CVE-2026-21513, CVE-2026-21510, CVE-2026-21514, CVE-2026-21519, CVE-2026-21525, CVE-2026-24300, CVE-2026-24302, CVE-2026-21532, CVE-2026-21522, CVE-2026-23655

## Description

February 2026 Patch Tuesday: Six Zero-Days Among 59 CVEs — Complete Analysis

Patch Tuesday Overview:
- Total CVEs: 59
- Actively Exploited Zero-Days: 6
- Publicly Disclosed (before patch): 3 of the 6 zero-days
- Critical Severity: 5
- Important Severity: 53
- Moderate Severity: 1
- Risk Types: Elevation of Privilege 25 (42%), Remote Code Execution 12 (20%), Spoofing 8 (14%)
- Most Patched Product: Windows (32 patches), ESU (25 patches)

=== THE SIX ZERO-DAYS ===

1. CVE-2026-21533 — Windows Remote Desktop Services Elevation of Privilege
- CVSS: 7.8 (Important)
- Status: Actively exploited, NOT publicly disclosed
- Discovery: CrowdStrike identified and reported to Microsoft
- Exploitation: Modifies service configuration key, replacing with attacker-controlled key → escalate to Administrator group
- Active Since: December 24, 2025 (at minimum) — targeting US and Canada-based entities
- CrowdStrike Assessment: Public disclosure will 'almost certainly' encourage broader exploitation by threat actors possessing exploit binaries and exploit brokers
- Attack Vector: Local, Low complexity, Low privilege required, No user interaction
- Impact: High to Confidentiality, Integrity, Availability
- CrowdStrike Intel: CSA-260174
- PATCH URGENCY: CRITICAL — actively exploited for 7+ weeks before patch

2. CVE-2026-21513 — MSHTML Framework Security Feature Bypass
- CVSS: 8.8 (Important)
- Status: Actively exploited AND publicly disclosed
- Exploitation: Remote attackers bypass security prompts when executing files via malicious HTML or .lnk shortcut files. Manipulates browser and Windows Shell handling — content executes without security warnings.
- Attack Vector: Network, Low complexity, No privileges required, Requires user interaction
- Impact: High to Confidentiality, Integrity, Availability
- Affected: Windows 10, Windows 11, Windows Server 2012+
- Social Engineering: Delivered via phishing emails with HTML attachments or malicious shortcut files
- PATCH URGENCY: CRITICAL — publicly disclosed + actively exploited + low complexity

3. CVE-2026-21510 — Windows Shell Security Feature Bypass
- CVSS: 8.8 (Important)
- Status: Actively exploited AND publicly disclosed
- Exploitation: Bypasses Windows SmartScreen and Windows Shell security prompts. Malicious links or shortcut files execute without user warning or consent.
- Attack Vector: Network, Low complexity, No privileges required, Requires user interaction
- Impact: High to Confidentiality, Integrity, Availability
- Technique: Exploits improper handling in Windows Shell components
- Social Engineering: Readily exploitable through phishing and social engineering
- PATCH URGENCY: CRITICAL — SmartScreen is a critical defense layer; bypass enables unopposed malware delivery

4. CVE-2026-21514 — Microsoft Word Security Feature Bypass
- CVSS: 7.8 (Important)
- Status: Actively exploited AND publicly disclosed
- Exploitation: Bypasses OLE (Object Linking and Embedding) mitigations in Microsoft 365 and Office. Malicious Office files execute vulnerable COM/OLE controls without protection.
- Attack Vector: Local, Low complexity, No privileges required, Requires user interaction
- Impact: High to Confidentiality, Integrity, Availability
- NOT via Preview Pane: Requires user to open the file
- Social Engineering: Phishing emails with malicious Word attachments
- PATCH URGENCY: HIGH — OLE bypass enables macro-style attacks without macro warnings

5. CVE-2026-21519 — Desktop Window Manager Elevation of Privilege
- CVSS: 7.8 (Important)
- Status: Actively exploited, NOT publicly disclosed
- Exploitation: Type confusion in Desktop Window Manager (dwm.exe). Local attacker with low privileges escalates to SYSTEM.
- Attack Vector: Local, Low complexity, Low privilege required, No user interaction
- Impact: High to Confidentiality, Integrity, Availability
- Note: No proven public exploit code, but active exploitation detected — threat actors possess working exploits
- DWM runs as SYSTEM — compromise = full system control
- PATCH URGENCY: CRITICAL — SYSTEM-level escalation with no user interaction required

6. CVE-2026-21525 — Windows Remote Access Connection Manager Denial of Service
- CVSS: 6.2 (Moderate)
- Status: Actively exploited, NOT publicly disclosed
- Exploitation: Null pointer dereference causes denial of service in RASMAN
- Attack Vector: Local, Low complexity, No privileges required, No user interaction
- Impact: High to Availability only
- Note: Lowest severity of the six zero-days; DoS only (no code execution)
- PATCH URGENCY: MODERATE — availability impact only, no privilege escalation

=== FIVE CRITICAL AZURE VULNERABILITIES ===

7. CVE-2026-24300 — Azure Front Door EoP (CVSS 9.8)
- Improper access control. Remote, no auth, no interaction. HIGHEST CVSS this month.
- Remediated server-side by Microsoft — no customer action required.

8. CVE-2026-24302 — Azure Arc EoP (CVSS 8.6)
- Improper access control with changed scope. Remote, no auth.
- Remediated server-side — no customer action required.

9. CVE-2026-21532 — Azure Function Information Disclosure (CVSS 8.2)
- Sensitive information exposure. Remote, no auth.
- Remediated server-side — no customer action required.

10. CVE-2026-21522 — ACI Confidential Containers EoP (CVSS 6.7)
- Command injection in Azure Compute Gallery. Local, high privileges required.
- PoC exists. Official fix available — customer must deploy.

11. CVE-2026-23655 — ACI Confidential Containers InfoDisc (CVSS 6.5)
- Cleartext storage of sensitive information. Remote, low privileges.
- Official fix available — customer must deploy.

=== STRATEGIC ANALYSIS ===

The Security Feature Bypass Cluster (CVE-2026-21513 + CVE-2026-21510 + CVE-2026-21514):
These three zero-days form a coordinated threat to Windows defense-in-depth:
- CVE-2026-21513 bypasses MSHTML security prompts
- CVE-2026-21510 bypasses SmartScreen and Shell security
- CVE-2026-21514 bypasses Office OLE mitigations
Together, they neutralize the three primary security gates that protect users from social engineering attacks. An attacker can deliver malicious content via HTML, shortcut files, or Office documents — and NONE of them will trigger security warnings. This is the most dangerous cluster because it turns every phishing email into a reliable initial access vector.

The Privilege Escalation Chain (CVE-2026-21533 + CVE-2026-21519):
Two zero-days that escalate from low-privilege to SYSTEM/Administrator:
- CVE-2026-21533 adds attacker to Administrator group via RDS service key manipulation
- CVE-2026-21519 escalates to SYSTEM via DWM type confusion
Combined with any of the security bypass zero-days for initial access, an attacker has a complete kill chain: bypass security warnings → gain initial access → escalate to SYSTEM → full compromise. All with actively exploited zero-days.

## MITRE ATT&CK

- T1566 Phishing
- T1204 User Execution
- T1203 Exploitation for Client Execution
- T1559 Inter-Process Communication
- T1068 Exploitation for Privilege Escalation
- T1134 Access Token Manipulation
- T1078 Valid Accounts
- T1553 Subvert Trust Controls
- T1218 System Binary Proxy Execution
- T1112 Modify Registry
- T1098 Account Manipulation
- T1136 Create Account
- T1499 Endpoint Denial of Service
- T1059 Command and Scripting Interpreter
- T1106 Native API
- T1547 Boot or Logon Autostart Execution
- T1543 Create or Modify System Process
- T1685 Disable or Modify Tools
- T1027 Obfuscated Files or Information
- T1003 OS Credential Dumping
- T1082 System Information Discovery
- T1518 Software Discovery
- T1021 Remote Services
- T1005 Data from Local System
- T1486 Data Encrypted for Impact

## Sources

- [CrowdStrike — February 2026 Patch Tuesday: Updates and Analysis](https://www.crowdstrike.com/en-us/blog/patch-tuesday-analysis-february-2026/)
- [Microsoft MSRC — CVE-2026-21533: Windows RDS EoP](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21533)
- [Microsoft MSRC — CVE-2026-21513: MSHTML Framework SFB](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21513)
- [Microsoft MSRC — CVE-2026-21510: Windows Shell SFB](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21510)
- [Microsoft MSRC — CVE-2026-21514: Microsoft Word SFB](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21514)
- [Microsoft MSRC — CVE-2026-21519: Desktop Window Manager EoP](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21519)
- [Microsoft MSRC — CVE-2026-21525: RASMAN DoS](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21525)
- [Microsoft MSRC — CVE-2026-24300: Azure Front Door EoP (CVSS 9.8)](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-24300)
- [Microsoft MSRC — February 2026 Release Notes](https://msrc.microsoft.com/update-guide/releaseNote/2026-Feb)
- [CrowdStrike Intelligence — CSA-260174 (CVE-2026-21533 detailed analysis)](https://falcon.crowdstrike.com/intelligence/reports/csa-260174)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0064