Microsoft Patch Tuesday February 2026: Six Actively Exploited Zero-Days Drive Urgent Patching

Microsoft’s February 2026 Patch Tuesday release stands out as one of the most urgent updates in recent months, addressing six actively exploited zero-day vulnerabilities alongside a broader set of security fixes. The unusually high number of in-the-wild exploits has prompted security teams worldwide to accelerate patch deployment cycles.

Three of the zero-days were publicly disclosed before patches were released, increasing the likelihood that threat actors were able to analyze and weaponize them. The affected components span core Windows functionality, Microsoft Word, Internet Explorer legacy components, and Remote Desktop Services.

With attackers actively leveraging several of these flaws, enterprises are being urged to prioritize updates immediately, particularly in environments exposed to internet-facing services.

Six Zero-Days Confirmed Under Active Exploitation

Microsoft confirmed that the February update resolves six zero-day vulnerabilities that were being exploited in real-world attacks. These include multiple security feature bypasses and elevation-of-privilege flaws affecting widely deployed Windows components.

The vulnerabilities addressed are:

• CVE-2026-21510 – Windows Shell Security Feature Bypass (CVSS 8.8)
• CVE-2026-21513 – Internet Explorer Security Feature Bypass (CVSS 8.8)
• CVE-2026-21514 – Microsoft Word Security Feature Bypass (CVSS 7.8)
• CVE-2026-21519 – Desktop Window Manager Elevation of Privilege (CVSS 7.8)
• CVE-2026-21533 – Windows Remote Desktop Services Elevation of Privilege (CVSS 7.8)
• CVE-2026-21525 – Windows Remote Access Connection Manager Denial of Service (CVSS 6.2)

Security feature bypass vulnerabilities are particularly concerning because they can allow attackers to circumvent built-in protections designed to block malicious code execution.

Attack Chains and Exploitation Risk

Analysts warn that several of these flaws are well suited for chaining. For example, a security feature bypass in Microsoft Word could be combined with an elevation-of-privilege vulnerability to move from initial document-based compromise to full system control.

Remote Desktop Services flaws further increase exposure risk in enterprise environments where RDP remains enabled for administrative access.

In recent campaigns, threat actors have leveraged similar combinations to gain initial footholds through phishing attachments before escalating privileges and deploying ransomware payloads.

The presence of multiple zero-days in a single release suggests coordinated exploitation activity rather than isolated incidents.

Internet Explorer Legacy Risk Persists

Although Internet Explorer has been deprecated, legacy components continue to exist within Windows environments for compatibility purposes.

CVE-2026-21513 demonstrates that these legacy attack surfaces remain viable entry points, particularly in enterprises that have not fully transitioned to modern browser architectures.

Security experts recommend auditing systems for residual IE dependencies and removing unnecessary legacy components wherever possible.

Operational Priorities for Security Teams

Organizations should prioritize patching systems exposed to external networks, including servers running Remote Desktop Services and endpoints frequently handling Office documents.

In addition to deploying updates, defenders are advised to monitor for indicators of exploitation attempts, such as abnormal RDP activity, unexpected privilege escalation events, and suspicious Office document behavior.

Where immediate patching is not feasible, temporary mitigations such as disabling vulnerable services, restricting RDP exposure, and enforcing least privilege access can reduce risk.

An Unusually Active Month for Exploits

February 2026 marks one of the highest counts of actively exploited zero-days addressed in a single Patch Tuesday cycle in recent memory.

The clustering of multiple in-the-wild exploits underscores the continued pressure on Microsoft’s ecosystem from financially motivated ransomware groups and state-aligned threat actors alike.

For enterprise defenders, the message is clear. Patch velocity and exposure management remain critical controls in an environment where zero-days are increasingly operationalized before official fixes become available.