Microsoft February Patch Tuesday Fixes Actively Exploited Zero-Days Including Windows RDS Privilege Escalation

Timeline

1. Feb 11, 2026

   CISA adds six Microsoft February flaws to the KEV catalog

   CISA added six Microsoft Windows and Office vulnerabilities from the February 2026 release to its Known Exploited Vulnerabilities catalog, citing active exploitation. The agency ordered U.S. federal civilian executive branch agencies to remediate the issues by March 3, 2026, and urged private organizations to prioritize patching as well.

2. Feb 10, 2026

   Microsoft discloses three of the exploited February flaws were publicly known

   Alongside the February 2026 Patch Tuesday release, Microsoft indicated that three of the six actively exploited vulnerabilities had also been publicly disclosed. These publicly known issues were security feature bypass flaws affecting Windows Shell, MSHTML/Trident, and Microsoft Word/OLE mitigations.

3. Feb 10, 2026

   Microsoft releases February 2026 Patch Tuesday updates

   Microsoft released its February 2026 Patch Tuesday security updates, fixing roughly 54-61 vulnerabilities across Windows, Office, Azure, Exchange Server, and related products. The release included six vulnerabilities that Microsoft said were actively exploited in the wild, spanning security feature bypass, elevation-of-privilege, and denial-of-service issues.

4. Feb 10, 2026

   0patch finds RasMan DoS exploit in a public malware repository

   0patch reported discovering exploit code for CVE-2026-21525, a Windows Remote Access Connection Manager denial-of-service flaw, in a public malware repository. The finding indicated the vulnerability was already accessible to attackers before Microsoft's February 2026 fixes.

5. Dec 24, 2025

   CrowdStrike observes exploitation of RDS zero-day CVE-2026-21533

   CrowdStrike reported that an exploit binary for the Windows Remote Desktop Services elevation-of-privilege flaw CVE-2026-21533 had been used against U.S. and Canada-based entities since at least December 24, 2025. The exploit modified a service configuration registry key to gain SYSTEM-level access and perform actions such as adding a user to the local Administrators group.