# February 2026 Patch Tuesday: Six Zero-Days Among 59 CVEs — CrowdStrike-Discovered RDP EoP Exploited Since December 2025

> Microsoft's February 2026 Patch Tuesday addresses 59 vulnerabilities including six actively exploited zero-day vulnerabilities and five Critical-severity flaws. The most significant is CVE-2026-21533 (CVSS 7.8), a Windows Remote Desktop Services elevation of privilege vulnerability discovered by CrowdStrike, actively exploited since December 24, 2025, targeting U.S. and Canadian entities. The exploit binary modifies a service configuration key to escalate privileges and add attacker-controlled accounts to the Administrator group. Three zero-days (CVE-2026-21513, CVE-2026-21510, CVE-2026-21514) are both actively exploited AND publicly disclosed, creating immediate mass exploitation risk. CVE-2026-21513 (MSHTML Framework, CVSS 8.8) and CVE-2026-21510 (Windows Shell, CVSS 8.8) both bypass security prompts via malicious HTML files or .lnk shortcut files — enabling code execution without user warning. CVE-2026-21514 (Word, CVSS 7.8) bypasses OLE mitigations in Office documents. CVE-2026-21519 (Desktop Window Manager, CVSS 7.8) provides SYSTEM-level privilege escalation via type confusion with no user interaction. Five Critical Azure vulnerabilities include CVE-2026-24300 (Azure Front Door, CVSS 9.8) — the highest-scoring CVE this month — though Azure cloud vulnerabilities were pre-remediated by Microsoft.

- **Published:** 2026-02-12T09:19:00Z
- **Last reviewed:** 2026-02-12T09:19:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0074
- **ID:** TL-2026-0074
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 12 · **IOCs:** 30 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-21533, CVE-2026-21513, CVE-2026-21510, CVE-2026-21514, CVE-2026-21519, CVE-2026-21525, CVE-2026-24300, CVE-2026-24302, CVE-2026-21532, CVE-2026-21522, CVE-2026-23655

## Description

The February 2026 Patch Tuesday represents the HIGHEST-RISK patch release in 2026 so far: six zero-days actively exploited in the wild, three of which were publicly disclosed before the patch. The vulnerability breakdown: 25 elevation of privilege (42%), 12 remote code execution (20%), 8 spoofing (14%), with Windows receiving 32 patches (most of any product). This patch release follows the January 2026 Patch Tuesday (TL-2026-0064, 6 zero-days among 59 CVEs) — two consecutive months of 6+ zero-days indicates an accelerating exploitation trend.

SIX ACTIVELY EXPLOITED ZERO-DAYS:

1. CVE-2026-21533 — Windows Remote Desktop Services EoP (CVSS 7.8)
   CROWDSTRIKE-DISCOVERED. Actively exploited since December 24, 2025 against U.S. and Canadian entities. The exploit binary modifies a service configuration key, replacing it with an attacker-controlled key, enabling privilege escalation to Administrator. CrowdStrike Intelligence assesses that Microsoft's public disclosure will 'almost certainly encourage threat actors possessing exploit binaries, as well as exploit brokers, to use or monetize the exploits in the near term.' This means exploitation will INCREASE after the patch release — organizations must patch immediately.

2. CVE-2026-21513 — MSHTML Framework Security Feature Bypass (CVSS 8.8)
   ACTIVELY EXPLOITED + PUBLICLY DISCLOSED. Remote attackers bypass security prompts when executing files by convincing users to open malicious HTML files or .lnk shortcut files. The files manipulate browser and Windows Shell handling, causing content to execute without proper security warnings. Low attack complexity, no privileges required — only user interaction needed. Affects Windows 10, Windows 11, and Windows Server back to Server 2012.

3. CVE-2026-21510 — Windows Shell Security Feature Bypass (CVSS 8.8)
   ACTIVELY EXPLOITED + PUBLICLY DISCLOSED. Remote attackers bypass SmartScreen and Windows Shell security prompts via malicious links or shortcut files. Exploits improper handling in Windows Shell components, enabling code execution without user warning. Low attack complexity — social engineering delivers the payload.

4. CVE-2026-21514 — Microsoft Word Security Feature Bypass (CVSS 7.8)
   ACTIVELY EXPLOITED + PUBLICLY DISCLOSED. Bypasses OLE (Object Linking and Embedding) mitigations in Microsoft 365 and Office. Malicious Office files exploit reliance on untrusted inputs in security decisions, allowing vulnerable COM/OLE controls to execute without protection. Delivered via phishing emails with malicious attachments. Preview Pane is NOT an attack vector.

5. CVE-2026-21519 — Desktop Window Manager EoP (CVSS 7.8)
   ACTIVELY EXPLOITED (not publicly disclosed). Type confusion in Desktop Window Manager allows local attackers with LOW privileges to escalate to SYSTEM. Requires NO user interaction, low attack complexity. Ideal post-exploitation privilege escalation — attackers who gain initial access via CVE-2026-21513 or CVE-2026-21510 chain to CVE-2026-21519 for SYSTEM access.

6. CVE-2026-21525 — Windows Remote Access Connection Manager DoS (CVSS 6.2)
   ACTIVELY EXPLOITED (not publicly disclosed). Null pointer dereference causes denial of service. No privileges required, no user interaction, low complexity. While DoS is lower impact than EoP, active exploitation indicates threat actors use it as part of broader attack chains.

FIVE CRITICAL VULNERABILITIES:
- CVE-2026-24300 — Azure Front Door EoP (CVSS 9.8) — the highest CVSS score this month. Pre-remediated by Microsoft in cloud infrastructure.
- CVE-2026-24302 — Azure Arc EoP (CVSS 8.6) — pre-remediated.
- CVE-2026-21532 — Azure Function Info Disclosure (CVSS 8.2) — pre-remediated.
- CVE-2026-21522 — ACI Confidential Containers EoP (CVSS 6.7) — customer-deployable fix available.
- CVE-2026-23655 — ACI Confidential Containers Info Disclosure (CVSS 6.5) — cleartext storage of secrets, customer-deployable fix.

ATTACK CHAIN ANALYSIS:
The most dangerous combination is CVE-2026-21513 or CVE-2026-21510 (initial access via social engineering — user opens malicious HTML/.lnk file, bypasses security warnings) → CVE-2026-21519 (privilege escalation to SYSTEM via type confusion, no user interaction) → CVE-2026-21533 (RDP persistence — modify service config for administrator access). This three-CVE chain provides: initial access + SYSTEM privileges + persistent admin access, all from a single social engineering interaction.

## MITRE ATT&CK

- T1566 Phishing
- T1204 User Execution
- T1203 Exploitation for Client Execution
- T1559 Inter-Process Communication
- T1543 Create or Modify System Process
- T1098 Account Manipulation
- T1068 Exploitation for Privilege Escalation
- T1134 Access Token Manipulation
- T1553 Subvert Trust Controls
- T1218 System Binary Proxy Execution
- T1685 Disable or Modify Tools
- T1003 OS Credential Dumping
- T1021 Remote Services
- T1499 Endpoint Denial of Service
- T1547 Boot or Logon Autostart Execution
- T1136 Create Account
- T1548 Abuse Elevation Control Mechanism
- T1112 Modify Registry
- T1036 Masquerading
- T1082 System Information Discovery
- T1087 Account Discovery
- T1005 Data from Local System
- T1041 Exfiltration Over C2 Channel
- T1071 Application Layer Protocol
- T1591 Gather Victim Org Information
- T1587 Develop Capabilities
- T1595 Active Scanning
- T1588 Obtain Capabilities
- T1059 Command and Scripting Interpreter
- T1007 System Service Discovery
- T1489 Service Stop

## Sources

- [CrowdStrike: February 2026 Patch Tuesday — Updates and Analysis](https://www.crowdstrike.com/en-us/blog/patch-tuesday-analysis-february-2026/)
- [Microsoft MSRC: February 2026 Security Updates Release Notes](https://msrc.microsoft.com/update-guide/releaseNote/2026-Feb)
- [MSRC: CVE-2026-21533 — Windows RDP Services EoP (CrowdStrike-discovered)](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21533)
- [MSRC: CVE-2026-21513 — MSHTML Framework Security Feature Bypass](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21513)
- [MSRC: CVE-2026-21510 — Windows Shell Security Feature Bypass](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21510)
- [MSRC: CVE-2026-21519 — Desktop Window Manager EoP](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21519)
- [CrowdStrike Intelligence: CSA-260174 — CVE-2026-21533 Exploitation Analysis](https://falcon.crowdstrike.com/intelligence/reports/csa-260174)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0074