Full Report
Today is Microsoft's February 2026 Patch Tuesday with security updates for 58 flaws, including 6 actively exploited and three publicly disclosed zero-day vulnerabilities. [...]
Analysis Summary
This summary focuses on the actively exploited and publicly disclosed vulnerabilities detailed in the Microsoft February 2026 Patch Tuesday advisory, based on the provided context.
---
# Vulnerability: Windows Shell Security Feature Bypass (Actively Exploited)
## CVE Details
- CVE ID: CVE-2026-21510
- CVSS Score: (Score not provided) (Important - based on context describing 6 actively exploited zero-days)
- CWE: (Not specified in context)
## Affected Systems
- Products: Windows
- Versions: Not specified in context
- Configurations: Requires user interaction to open a malicious link or shortcut file.
## Vulnerability Description
A Security Feature Bypass vulnerability in Windows Shell components that can be triggered by opening a specially crafted link or shortcut file. Successful exploitation allows an attacker to bypass Windows SmartScreen and Windows Shell security prompts, likely allowing attacker-controlled content to execute without proper user warning or consent (suggesting Mark of the Web bypass).
## Exploitation
- Status: Actively Exploited
- Complexity: (Not specified, but likely Low given context of user interaction via link/shortcut)
- Attack Vector: Network/Local (Requires user to click link/open file)
## Impact
- Confidentiality: (Not specified)
- Integrity: (Not specified)
- Availability: (Not specified)
## Remediation
### Patches
- Vendor Advisory confirms a patch is available as part of the Feb 2026 Release. Specific KB numbers are not detailed in this section.
### Workarounds
- None explicitly listed, though social engineering techniques against necessary user interaction might imply a temporary defense.
## Detection
- Focus on monitoring user activity related to opening newly downloaded or received shortcut files or links that trigger unexpected application execution or bypass security prompts.
## References
- Vendor Advisory: hxxps://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2026-21510
---
# Vulnerability: MSHTML Framework Security Feature Bypass (Actively Exploited)
## CVE Details
- CVE ID: CVE-2026-21513
- CVSS Score: (Score not provided) (Important - based on context describing 6 actively exploited zero-days)
- CWE: Protection mechanism failure in MSHTML Framework
## Affected Systems
- Products: Windows
- Versions: Not specified in context
- Configurations: Exploitation occurs over a network.
## Vulnerability Description
A Security Feature Bypass flaw in the MSHTML Framework on Windows. This protection mechanism failure allows an unauthorized attacker to bypass a security feature over a network connection.
## Exploitation
- Status: Actively Exploited
- Complexity: (Not specified)
- Attack Vector: Network
## Impact
- Confidentiality: (Not specified)
- Integrity: (Not specified)
- Availability: (Not specified)
## Remediation
### Patches
- Vendor Advisory confirms a patch is available as part of the Feb 2026 Release.
### Workarounds
- None explicitly listed.
## Detection
- Monitoring network traffic targeted at MSHTML components or unusual process initiation following network connection events.
## References
- Vendor Advisory: hxxps://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2026-21513
---
# Vulnerability: Microsoft Word Security Feature Bypass (Actively Exploited)
## CVE Details
- CVE ID: CVE-2026-21514
- CVSS Score: (Score not provided) (Important - based on context describing 6 actively exploited zero-days)
- CWE: (Related to OLE/COM handling)
## Affected Systems
- Products: Microsoft Word, Microsoft 365
- Versions: Not specified in context
- Configurations: Requires the user to open a malicious Office file. *Note: Not exploitable in the Office Preview Pane.*
## Vulnerability Description
A Security Feature Bypass flaw in Microsoft Word that bypasses existing OLE mitigations designed to protect users from vulnerable COM/OLE controls. Exploitation requires an attacker to send a malicious Office file and convince the user to open it.
## Exploitation
- Status: Actively Exploited
- Complexity: (Not specified, likely Medium, requires social engineering)
- Attack Vector: Local (via file opening)
## Impact
- Confidentiality: (Not specified)
- Integrity: (Not specified)
- Availability: (Not specified)
## Remediation
### Patches
- Vendor Advisory confirms a patch is available as part of the Feb 2026 Release.
### Workarounds
- Users should avoid opening untrusted Office files received from external sources.
## Detection
- EDR/AV systems should flag or block macros/OLE controls embedded in newly opened Word documents, especially those bypassing standard security checks.
## References
- Vendor Advisory: hxxps://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2026-21514
---
# Vulnerability: Desktop Window Manager Elevation of Privilege (Actively Exploited)
## CVE Details
- CVE ID: CVE-2026-21519
- CVSS Score: (Score not provided) (Implied High, leads to SYSTEM)
- CWE: Elevation of Privilege
## Affected Systems
- Products: Windows (Desktop Window Manager component)
- Versions: Not specified in context
- Configurations: (Not specified)
## Vulnerability Description
An Elevation of Privilege (EoP) flaw within the Desktop Window Manager (DWM). Successful exploitation grants an attacker **SYSTEM privileges**.
## Exploitation
- Status: Actively Exploited
- Complexity: (Not specified, EoP flaws can vary)
- Attack Vector: Local (usually requires prior low-privilege access)
## Impact
- Confidentiality: High (SYSTEM access)
- Integrity: High (SYSTEM access)
- Availability: High (SYSTEM access)
## Remediation
### Patches
- Vendor Advisory confirms a patch is available as part of the Feb 2026 Release.
### Workarounds
- None explicitly listed.
## Detection
- Focus on abnormal process execution or unauthorized attempts to interact with DWM components that result in escalation to SYSTEM context.
## References
- Vendor Advisory: hxxps://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2026-21519
**(Note: The context lists five actively exploited zero-days, but only details four before being truncated. CVE-2026-21525 is mentioned as exploited but details were cut off.)**
---
# Comprehensive Summary of 58 Flaws
Microsoft released updates for **58 vulnerabilities** in February 2026, including **6 actively exploited zero-days** and **3 publicly disclosed zero-days**. Five vulnerabilities were rated "Critical."
## Vulnerability Breakdown Summary:
| Category | Count | Notes |
| :--- | :--- | :--- |
| Elevation of Privilege | 25 | Includes CVE-2026-21519 (SYSTEM access). |
| Remote Code Execution (RCE) | 12 | |
| Information Disclosure | 6 | Two rated "Critical." |
| Security Feature Bypass | 5 | Includes three actively exploited flaws (CVE-2026-21510, -21513, -21514). |
| Spoofing | 7 | Includes NTLM Spoofing (CVE-2026-21249). |
| Denial of Service (DoS) | 3 | Includes CVE-2026-21525. |
## General Remediation Strategy
Due to the presence of six actively exploited vulnerabilities, immediate patching is strongly recommended for all affected systems across Windows and Microsoft Office products. Focus initial efforts on deploying updates addressing the actively exploited flaws (CVE-2026-21510, -21513, -21514, -21519, and at least one other).
## References
- Vendor Security Update Guide: (Not possible to link directly, search Microsoft MSRC for February 2026)
- Windows 11 Updates Tracked Separately: hxxps://www.bleepingcomputer.com/news/microsoft/windows-11-kb5077181-and-kb5077181-cumulative-updates-released/ (Non-security related info)