Actively exploited Microsoft zero-days patched in February security updates
Microsoft disclosed and patched multiple actively exploited vulnerabilities as part of its February security updates, including a Microsoft Word security feature bypass tracked as CVE-2026-21514. The Word flaw (CVSS 7.8; CWE-807) allows attackers to bypass Object Linking and Embedding (OLE)-related mitigations by abusing how Word makes security decisions based on untrusted inputs; exploitation is described as requiring a crafted document and user interaction (e.g., opening a phishing-delivered file) while avoiding typical prompts such as Protected View or “Enable Content” warnings.
Microsoft also addressed an in-the-wild exploited Windows Desktop Window Manager (dwm.exe) elevation-of-privilege vulnerability, CVE-2026-21519 (CVSS 7.8), which can allow a local attacker to escalate from a standard user context to SYSTEM. The February update review also lists additional exploited issues patched in the same release, including security feature bypasses in Windows Shell (CVE-2026-21510) and Internet Explorer (CVE-2026-21513), plus other exploited vulnerabilities (e.g., Windows Remote Desktop Services EoP CVE-2026-21533), underscoring that defenders should prioritize rapid deployment of the February fixes across affected Windows and Office estates.
Timeline
Mar 3, 2026
CISA sets federal patch deadline for Word zero-day
CISA set a 2026-03-03 deadline for U.S. federal civilian agencies to remediate CVE-2026-21514 after it was disclosed as actively exploited. The directive elevated urgency around patching the Microsoft Word zero-day.
Feb 10, 2026
Microsoft patches exploited DWM zero-day CVE-2026-21519 in February updates
On 2026-02-10, Microsoft addressed CVE-2026-21519 in the February 2026 security update, fixing an actively exploited Windows Desktop Window Manager flaw that could allow local privilege escalation to SYSTEM. The issue affects multiple Windows 10, Windows 11, and Windows Server versions, with no workaround other than patching.
Feb 10, 2026
Microsoft issues Office fixes for Word zero-day CVE-2026-21514
Microsoft released Click-to-Run updates for affected Windows and Mac Office products to address CVE-2026-21514, including version 16.106.26020821. The fixes cover multiple Office product lines such as Microsoft 365 Apps for Enterprise and Office LTSC 2021/2024.
Feb 10, 2026
Microsoft discloses actively exploited Word zero-day CVE-2026-21514
On 2026-02-10, Microsoft disclosed CVE-2026-21514, a Microsoft Word security feature bypass flaw that abuses untrusted input handling to bypass OLE mitigations for malicious COM/OLE controls. The vulnerability was reported as actively exploited in the wild and can be triggered when a user opens a specially crafted Office document.
Feb 10, 2026
Microsoft's February 2026 security updates disclose multiple exploited zero-days
On 2026-02-10, Microsoft's February 2026 security release was reviewed publicly, listing several vulnerabilities as exploited in the wild, including Microsoft Word security feature bypass CVE-2026-21514 and Desktop Window Manager elevation-of-privilege CVE-2026-21519. The release also covered fixes across Windows, Office, Azure, and other Microsoft products.
See the full picture in Mallory
Mallory subscribers get deeper analysis on every story, including:
Who’s affected and how
Deep-dive technical analysis
Actionable next steps for your team
IPs, domains, hashes, and more
Ask questions and take action on every story
Filter by topic, classification, timeframe
Get matching stories delivered automatically
Related Entities
Vulnerabilities
Organizations
Sources
Related Stories
Microsoft February Patch Tuesday Fixes Actively Exploited Zero-Days Including Windows RDS Privilege Escalation
Microsoft’s February 2026 Patch Tuesday shipped fixes for **58 vulnerabilities** across Windows, Office, and related components, including **six zero-days reported as actively exploited**. Reported zero-days included **CVE-2026-21533** (Windows **Remote Desktop Services** elevation of privilege), **CVE-2026-21510** (Windows Shell security feature bypass involving SmartScreen/Mark-of-the-Web), **CVE-2026-21513** and **CVE-2026-21514** (Office/MSHTML mitigation bypasses requiring user interaction), and **CVE-2026-21525** (Windows Remote Access Connection Manager DoS). Coverage of the release emphasized that elevation-of-privilege issues were the largest category in the update set, and that organizations should prioritize rapid deployment given in-the-wild exploitation claims. For **CVE-2026-21533** (CVSS 7.8, *Important*), reporting cited CrowdStrike observations of an exploit binary used post-compromise to reach **SYSTEM** by modifying a service configuration **registry key** to point to attacker-controlled values, enabling actions such as adding a user to the local Administrators group; the issue primarily impacts Windows systems where RDS is enabled and is positioned as a strong enabler for lateral movement in RDP-heavy environments. Separately, a January 2026-patched local privilege escalation in Windows Error Reporting, **CVE-2026-20817** (CVSS 7.8), was described with technical detail and a released PoC: the WER service (`wersvc.dll`) allegedly failed to validate requester permissions over ALPC, allowing a standard user to trigger process creation with a SYSTEM-derived token retaining powerful privileges (e.g., `SeDebugPrivilege`, `SeImpersonatePrivilege`, `SeBackupPrivilege`), underscoring the broader trend of Windows local EoP bugs being leveraged for post-exploitation escalation.
1 months ago
Microsoft Patch Tuesday Fixes Six Actively Exploited Zero-Days Including Windows Shell SmartScreen Bypass
Microsoft released its February Patch Tuesday security updates addressing **~58–59 vulnerabilities** across Windows and other products, including **six zero-day flaws confirmed as actively exploited in the wild** and **five Critical** issues. Reported vulnerability classes were led by **Elevation of Privilege (25)**, followed by **Remote Code Execution (12)** and **Security Feature Bypass (5)**, with additional fixes for spoofing, information disclosure, DoS, and XSS; Microsoft also noted additional *Edge* fixes shipped outside the prior Patch Tuesday cadence, including an Android spoofing issue (`CVE-2026-0391`). One of the actively exploited zero-days highlighted across reporting is `CVE-2026-21510`, a **Windows Shell security feature bypass** that can be abused to evade **Mark-of-the-Web/SmartScreen-style warnings** by using specially crafted files (e.g., shortcut/link formats) so that untrusted content can execute without expected prompts, making it well-suited to phishing and social-engineering delivery. Separate coverage also noted Microsoft’s rollout of **updated Secure Boot certificates** ahead of the June 2026 expiration of legacy 2011 certificates, a change with broad implications for Windows boot integrity and enterprise device management.
1 months ago
Microsoft January Patch Tuesday Fixes 114 Vulnerabilities Including Three Zero-Days
Microsoft’s January Patch Tuesday security updates addressed **114 vulnerabilities**, including **three zero-days** reported as publicly known and/or exploited. Reported issues span multiple Windows and Microsoft product components, including **Desktop Window Manager (DWM)**, legacy modem drivers, and core OS services, with a mix of **information disclosure**, **elevation of privilege (EoP)**, **security feature bypass**, and **remote code execution (RCE)** flaws. Technical highlights called out include **CVE-2023-31096** (Windows Agere Soft Modem Driver EoP), **CVE-2026-20805** (DWM information disclosure), and a **Secure Boot certificate expiration** security feature bypass (**CVE-2026-21265**). The update set also includes multiple **Office/Excel/Word RCE** vulnerabilities (e.g., **CVE-2026-20952**, **CVE-2026-20953**, **CVE-2026-20955**, **CVE-2026-20957**, **CVE-2026-20944**), Windows privilege-escalation issues (e.g., **Windows Graphics Component** and **VBS Enclave** EoP), and cloud/agent components such as **Azure Connected Machine Agent** (**CVE-2026-21224**) and **Azure Core shared client library for Python** (**CVE-2026-21226**).
1 months ago