February 2026 Patch Tuesday: six Microsoft zero-days under attack

February 2026 Patch Tuesday was not routine maintenance. Microsoft confirmed active exploitation of six zero-days: CVE-2026-21510, CVE-2026-21513, CVE-2026-21514, CVE-2026-21519, CVE-2026-21525 and CVE-2026-21533. CISA added all six to KEV with a 3 March remediation deadline for US federal agencies. Three bypassed content protections, two elevated local privileges and one disrupted Remote Access Connection Manager.

This was a cluster rather than one universal exploit. The realistic model chains roles: a security-feature bypass helps content run despite warnings, while local elevation turns the user’s process into a higher-privilege one. Prioritising only by CVSS misses how each primitive fits into an intrusion.

The six roles

CVE-2026-21510 (Windows Shell, CVSS 8.8) bypasses a security feature. The scenario involves convincing a user to open a malicious link or shortcut. The important failure is loss of a warning or reputation boundary intended to separate internet content from trusted files.

CVE-2026-21513 (MSHTML Framework, CVSS 8.8) is another security-feature bypass. MSHTML remains a compatibility component used outside the retired Internet Explorer browser. Akamai later published patch-diff analysis of the in-the-wild route.

CVE-2026-21514 (Microsoft Word, CVSS 7.8) bypasses document security and requires user interaction. Office documents remain effective initial access when a trusted theme and normal format are combined with a protection bypass.

CVE-2026-21519 (Desktop Window Manager, CVSS 7.8) is local privilege escalation through type confusion. DWM’s privileged role in desktop composition turns a memory-safety defect into high confidentiality, integrity and availability impact.

CVE-2026-21525 (Remote Access Connection Manager, CVSS 6.2) is local denial of service through a null-pointer dereference. It has the lowest score in the group, yet active exploitation and RasMan’s VPN role can make it a way to disrupt remote staff or incident response.

CVE-2026-21533 (Remote Desktop Services, CVSS 7.8) involves improper privilege management and local elevation. In a compromised RDP session or multi-user host, “local” is an important post-access step rather than a minor qualifier.

“Important” does not mean “can wait”

Microsoft rates several as Important rather than Critical. Severity describes technical conditions in the vendor model, not likelihood in your environment. KEV and exploitation change the priority. A user-interaction bypass is common when phishing reaches thousands of mailboxes; local elevation is critical on VDI, terminal servers and administrator laptops.

Patch systems combining likely entry with valuable identity first: privileged workstations, VDI/RDS, VPN laptops, document-processing endpoints and multi-user servers. Check each MSRC entry for exact products rather than assuming all Windows roles have identical scope.

Deploy with evidence

1. Build a device list with build, role, exposure and owner.
2. Pilot representative Office, VPN/RasMan, RDP/VDI, GPU and legacy-MSHTML groups.
3. Deploy the security update and required servicing stack on an emergency schedule.
4. Confirm the running post-reboot build, not only an “installed” state.
5. Cover offline, DR, unmanaged and out-of-domain systems.
6. Measure coverage per CVE and device class; every exception needs an owner and expiry.

A machine that downloaded an update but awaits restart may still execute old code. Closure requires evidence of the active version.

Hunt the chain, not the CVE label

Telemetry rarely states “CVE-2026-21513 exploited”. Look for behaviours matching stages:

• internet-originated document or shortcut launches an unusual child process;
• Word, an HTML component or Explorer starts a script, LOLBin or network connection;
• a user process opens privileged handles or suddenly changes integrity level;
• abnormal RDP activity precedes service, task or administrator creation;
• RasMan stops alongside local activity and VPN disruption;
• initial access is followed by token theft, credential dumping or protection changes.

Correlate email, EDR, AMSI, Defender, proxy and identity logs. Preserve attachments or URLs in quarantine; do not manually open them on an ordinary workstation.

Compensating controls

Restrict risky attachments and shortcuts, preserve Protected View and Mark-of-the-Web, isolate unknown content, block unnecessary Office child processes with ASR and apply application control to privileged workstations. Put RDP behind a bastion with NLA, MFA and segmentation. These controls reduce exposure but do not replace February’s fixes.

After deployment, review exceptions because a “temporary” ASR or Protected View exemption often becomes permanent. Connect this work with Microsoft 365 security, vulnerability management and detection engineering. For independent coverage validation and endpoint testing, contact BreachRoad.

---

Primary sources: Microsoft MSRC for CVE-2026-21510, CVE-2026-21513, CVE-2026-21514, CVE-2026-21519, CVE-2026-21525 and CVE-2026-21533, CISA KEV. Technical analysis: Akamai — CVE-2026-21513.