February 2026 Patch Tuesday: Six Zero-Days Among 59 CVEs — CrowdStrike-Discovered RDP EoP Exploited Since December 2025

February 2026 Patch Tuesday (TL-2026-0074) is a critical-severity software vulnerability scored CVSS 9.8, first published 2026-02-12. It has no confirmed attribution, references 11 CVEs (CVE-2026-21533, CVE-2026-21513, CVE-2026-21510), maps to 31 MITRE ATT&CK techniques (T1003, T1005, T1007), and is covered by 12 detection rules and 30 indicators of compromise.

Key facts for TL-2026-0074

Threat ID
TL-2026-0074
Severity
CRITICAL
CVSS
9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Status
PATCHED
Category
VULNERABILITY
First published
2026-02-12
Last reviewed
2026-02-12
Attribution confidence
NONE
Motivation
UNKNOWN
Target sectors
Government, Technology, Financial Services, Healthcare, All Sectors
Target regions
United States, Canada, Global
Detection rules
12
Indicators of compromise
30

Microsoft's February 2026 Patch Tuesday addresses 59 vulnerabilities including six actively exploited zero-day vulnerabilities and five Critical-severity flaws. The most significant is CVE-2026-21533 (CVSS 7.8), a Windows Remote Desktop Services elevation of privilege vulnerability discovered by CrowdStrike, actively exploited since December 24, 2025, targeting U.S. and Canadian entities. The exploit binary modifies a service configuration key to escalate privileges and add attacker-controlled accounts to the Administrator group. Three zero-days (CVE-2026-21513, CVE-2026-21510, CVE-2026-21514) are both actively exploited AND publicly disclosed, creating immediate mass exploitation risk. CVE-2026-21513 (MSHTML Framework, CVSS 8.8) and CVE-2026-21510 (Windows Shell, CVSS 8.8) both bypass security prompts via malicious HTML files or .lnk shortcut files — enabling code execution without user warning. CVE-2026-21514 (Word, CVSS 7.8) bypasses OLE mitigations in Office documents. CVE-2026-21519 (Desktop Window Manager, CVSS 7.8) provides SYSTEM-level privilege escalation via type confusion with no user interaction. Five Critical Azure vulnerabilities include CVE-2026-24300 (Azure Front Door, CVSS 9.8) — the highest-scoring CVE this month — though Azure cloud vulnerabilities were pre-remediated by Microsoft.

How February 2026 Patch Tuesday works

The February 2026 Patch Tuesday represents the HIGHEST-RISK patch release in 2026 so far: six zero-days actively exploited in the wild, three of which were publicly disclosed before the patch. The vulnerability breakdown: 25 elevation of privilege (42%), 12 remote code execution (20%), 8 spoofing (14%), with Windows receiving 32 patches (most of any product). This patch release follows the January 2026 Patch Tuesday (TL-2026-0064, 6 zero-days among 59 CVEs) — two consecutive months of 6+ zero-days indicates an accelerating exploitation trend.

SIX ACTIVELY EXPLOITED ZERO-DAYS:

1. CVE-2026-21533 — Windows Remote Desktop Services EoP (CVSS 7.8) CROWDSTRIKE-DISCOVERED. Actively exploited since December 24, 2025 against U.S. and Canadian entities. The exploit binary modifies a service configuration key, replacing it with an attacker-controlled key, enabling privilege escalation to Administrator. CrowdStrike Intelligence assesses that Microsoft's public disclosure will 'almost certainly encourage threat actors possessing exploit binaries, as well as exploit brokers, to use or monetize the exploits in the near term.' This means exploitation will INCREASE after the patch release — organizations must patch immediately.

2. CVE-2026-21513 — MSHTML Framework Security Feature Bypass (CVSS 8.8) ACTIVELY EXPLOITED + PUBLICLY DISCLOSED. Remote attackers bypass security prompts when executing files by convincing users to open malicious HTML files or .lnk shortcut files. The files manipulate browser and Windows Shell handling, causing content to execute without proper security warnings. Low attack complexity, no privileges required — only user interaction needed. Affects Windows 10, Windows 11, and Windows Server back to Server 2012.

3. CVE-2026-21510 — Windows Shell Security Feature Bypass (CVSS 8.8) ACTIVELY EXPLOITED + PUBLICLY DISCLOSED. Remote attackers bypass SmartScreen and Windows Shell security prompts via malicious links or shortcut files. Exploits improper handling in Windows Shell components, enabling code execution without user warning. Low attack complexity — social engineering delivers the payload.

4. CVE-2026-21514 — Microsoft Word Security Feature Bypass (CVSS 7.8) ACTIVELY EXPLOITED + PUBLICLY DISCLOSED. Bypasses OLE (Object Linking and Embedding) mitigations in Microsoft 365 and Office. Malicious Office files exploit reliance on untrusted inputs in security decisions, allowing vulnerable COM/OLE controls to execute without protection. Delivered via phishing emails with malicious attachments. Preview Pane is NOT an attack vector.

5. CVE-2026-21519 — Desktop Window Manager EoP (CVSS 7.8) ACTIVELY EXPLOITED (not publicly disclosed). Type confusion in Desktop Window Manager allows local attackers with LOW privileges to escalate to SYSTEM. Requires NO user interaction, low attack complexity. Ideal post-exploitation privilege escalation — attackers who gain initial access via CVE-2026-21513 or CVE-2026-21510 chain to CVE-2026-21519 for SYSTEM access.

6. CVE-2026-21525 — Windows Remote Access Connection Manager DoS (CVSS 6.2) ACTIVELY EXPLOITED (not publicly disclosed). Null pointer dereference causes denial of service. No privileges required, no user interaction, low complexity. While DoS is lower impact than EoP, active exploitation indicates threat actors use it as part of broader attack chains.

FIVE CRITICAL VULNERABILITIES: - CVE-2026-24300 — Azure Front Door EoP (CVSS 9.8) — the highest CVSS score this month. Pre-remediated by Microsoft in cloud infrastructure. - CVE-2026-24302 — Azure Arc EoP (CVSS 8.6) — pre-remediated. - CVE-2026-21532 — Azure Function Info Disclosure (CVSS 8.2) — pre-remediated. - CVE-2026-21522 — ACI Confidential Containers EoP (CVSS 6.7) — customer-deployable fix available. - CVE-2026-23655 — ACI Confidential Containers Info Disclosure (CVSS 6.5) — cleartext storage of secrets, customer-deployable fix.

ATTACK CHAIN ANALYSIS: The most dangerous combination is CVE-2026-21513 or CVE-2026-21510 (initial access via social engineering — user opens malicious HTML/.lnk file, bypasses security warnings) → CVE-2026-21519 (privilege escalation to SYSTEM via type confusion, no user interaction) → CVE-2026-21533 (RDP persistence — modify service config for administrator access). This three-CVE chain provides: initial access + SYSTEM privileges + persistent admin access, all from a single social engineering interaction.

MITRE ATT&CK techniques used in TL-2026-0074

credential-access

T1003 OS Credential Dumping

collection

T1005 Data from Local System

discovery

T1007 System Service Discovery; T1082 System Information Discovery; T1087 Account Discovery

lateral-movement

T1021 Remote Services

defense-evasion

T1036 Masquerading; T1134 Access Token Manipulation; T1218 System Binary Proxy Execution

exfiltration

T1041 Exfiltration Over C2 Channel

execution

T1059 Command and Scripting Interpreter; T1203 Exploitation for Client Execution; T1204 User Execution; T1559 Inter-Process Communication

privilege-escalation

T1068 Exploitation for Privilege Escalation; T1548 Abuse Elevation Control Mechanism

command-and-control

T1071 Application Layer Protocol

persistence

T1098 Account Manipulation; T1136 Create Account; T1543 Create or Modify System Process; T1547 Boot or Logon Autostart Execution

defense-impairment

T1112 Modify Registry; T1553 Subvert Trust Controls; T1685 Disable or Modify Tools

impact

T1489 Service Stop; T1499 Endpoint Denial of Service

initial-access

T1566 Phishing

resource-development

T1587 Develop Capabilities; T1588 Obtain Capabilities

reconnaissance

T1591 Gather Victim Org Information; T1595 Active Scanning

Remediation for February 2026 Patch Tuesday

Patches

  • CVE-2026-21533 — Windows Remote Desktop Services EoP (CVSS 7.8) — ACTIVELY EXPLOITED since Dec 2025
  • CVE-2026-21513 — MSHTML Framework SFB (CVSS 8.8) — ACTIVELY EXPLOITED + PUBLICLY DISCLOSED
  • CVE-2026-21510 — Windows Shell SFB (CVSS 8.8) — ACTIVELY EXPLOITED + PUBLICLY DISCLOSED
  • CVE-2026-21514 — Microsoft Word SFB (CVSS 7.8) — ACTIVELY EXPLOITED + PUBLICLY DISCLOSED
  • CVE-2026-21519 — Desktop Window Manager EoP (CVSS 7.8) — ACTIVELY EXPLOITED
  • CVE-2026-21525 — Remote Access Connection Manager DoS (CVSS 6.2) — ACTIVELY EXPLOITED
  • CVE-2026-24300 — Azure Front Door EoP (CVSS 9.8) — CRITICAL, pre-remediated
  • CVE-2026-24302 — Azure Arc EoP (CVSS 8.6) — CRITICAL, pre-remediated
  • CVE-2026-21532 — Azure Function Info Disclosure (CVSS 8.2) — CRITICAL, pre-remediated
  • CVE-2026-21522 — ACI Confidential Containers EoP (CVSS 6.7) — CRITICAL

Immediate actions

  • EMERGENCY PATCH CVE-2026-21533 (RDP EoP) — CrowdStrike warns exploitation will INCREASE after public disclosure. Actively exploited since December 2025 against U.S. and Canadian entities
  • EMERGENCY PATCH CVE-2026-21513 (MSHTML) and CVE-2026-21510 (Windows Shell) — both CVSS 8.8, publicly disclosed + actively exploited. Social engineering delivery via malicious HTML/.lnk files
  • EMERGENCY PATCH CVE-2026-21514 (Word OLE bypass) — publicly disclosed + actively exploited. Block suspicious Office attachments at email gateway
  • EMERGENCY PATCH CVE-2026-21519 (DWM type confusion) — provides SYSTEM-level escalation with no user interaction. Critical post-exploitation tool
  • Deploy patches for ALL 59 CVEs within emergency window (24-72 hours for Critical/Important zero-days)

Workarounds

  • Until patches are deployed: block .lnk and .html file attachments at the email gateway to mitigate CVE-2026-21513 and CVE-2026-21510 delivery
  • Enable ASR rule 'Block Office applications from creating child processes' to mitigate CVE-2026-21514
  • Restrict RDP access via firewall rules and require network-level authentication for CVE-2026-21533
  • Monitor for Desktop Window Manager exploitation indicators for CVE-2026-21519 using EDR
  • Azure customers: verify automatic remediation status for CVE-2026-24300/24302/21532 in Azure portal

Longer-term hardening

  • Implement attack surface reduction (ASR) rules to block Office child process creation and script execution from Office applications — mitigates CVE-2026-21514 OLE bypass
  • Restrict .lnk and .html file delivery via email — CVE-2026-21513 and CVE-2026-21510 are delivered via these file types through social engineering
  • Enable Windows Defender SmartScreen with strict enforcement — zero-days CVE-2026-21513 and CVE-2026-21510 bypass SmartScreen, but patching restores protection
  • Restrict RDP access to authorized users only and implement network-level authentication — reduces CVE-2026-21533 exposure surface
  • Establish continuous vulnerability monitoring cadence — two consecutive months of 6+ zero-days indicates acceleration in exploitation

CVEs associated with February 2026 Patch Tuesday

CVE-2026-21533, CVE-2026-21513, CVE-2026-21510, CVE-2026-21514, CVE-2026-21519, CVE-2026-21525, CVE-2026-24300, CVE-2026-24302, CVE-2026-21532, CVE-2026-21522, CVE-2026-23655

Weaknesses (CWE) in February 2026 Patch Tuesday

CWE-269, CWE-843, CWE-476, CWE-284, CWE-200

Timeline of February 2026 Patch Tuesday

  • CrowdStrike Intelligence retrospective hunting reveals threat actors using CVE-2026-21533 exploit binaries in the wild targeting U.S. and Canada-based entities since at least this date — 49 days before the patch. Source: CrowdStrike
  • Threadlinqs identifies three-CVE attack chain: CVE-2026-21513 or CVE-2026-21510 (initial access via SE) → CVE-2026-21519 (SYSTEM escalation, no user interaction) → CVE-2026-21533 (RDP persistence via service config modification). Complete compromise from single social engineering interaction. Source: Threadlinqs analysis
  • Microsoft pre-remediates three Critical Azure cloud vulnerabilities (CVE-2026-24300 CVSS 9.8, CVE-2026-24302 CVSS 8.6, CVE-2026-21532 CVSS 8.2) transparently — no customer action required. Published for transparency. Source: Microsoft MSRC
  • Three zero-days both actively exploited AND publicly disclosed simultaneously: CVE-2026-21513 (MSHTML, 8.8), CVE-2026-21510 (Windows Shell, 8.8), CVE-2026-21514 (Word OLE, 7.8). Maximum exploitation risk — public disclosure + active exploitation + available patch details. Source: Microsoft MSRC
  • CrowdStrike publicly reports CVE-2026-21533 discovery — Windows RDP EoP exploited since December 2025. CrowdStrike assesses disclosure will 'almost certainly encourage' broader exploitation and monetization. Source: CrowdStrike CSA-260174
  • Microsoft releases February 2026 Patch Tuesday addressing 59 vulnerabilities: 6 actively exploited zero-days (3 publicly disclosed), 5 Critical, 25 EoP (42%), 12 RCE (20%), 8 spoofing (14%). Windows receives 32 patches. Source: Microsoft/CrowdStrike
  • CrowdStrike Intelligence assesses increased exploitation of CVE-2026-21533 following public disclosure — exploit brokers and threat actors expected to monetize or deploy exploit binaries. 72-hour patch window critical. Source: CrowdStrike Intelligence
  • As of 2026-05-29, status PATCHED holds: Microsoft shipped fixes for all 11 CVEs (six exploited zero-days) on 2026-02-11 and CISA added the six to KEV with a 2026-03-03 federal deadline. Not active for patched orgs, but residual risk persists — a CVE-2026-21533 PoC hit GitHub and a $220K exploit sale appeared on dark-web forums.

Sources cited for February 2026 Patch Tuesday

Threats related to February 2026 Patch Tuesday

Detection coverage for TL-2026-0074

As of 2026-02-12, Threadlinqs Intelligence publishes 12 detection rule(s) for TL-2026-0074 across Splunk SPL, Microsoft KQL and Sigma, covering 30 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats