Five zero-days ship inside the Windows cumulative — deploy it first. CVE-2026-21510 (Shell), CVE-2026-21513 (MSHTML), CVE-2026-21519 (Desktop Window Manager), CVE-2026-21525 (RAS Connection Manager) and CVE-2026-21533 (Remote Desktop Services) were all exploited in the wild and CISA KEV-listed on release day. This is an evidence-lane emergency change, not a normal cycle.
A sixth zero-day is in Word. CVE-2026-21514, an OLE mitigation bypass, was also exploited and KEV-listed the same day — patch the Office estate alongside the cumulative.
Three of the six were public before the patch. CVE-2026-21510, CVE-2026-21513 and CVE-2026-21514 were publicly disclosed at release, so exploitation detail was in the open immediately.
Patching is not the whole job. All six were exploited as zero-days before their fixes existed. Deploying closes the door; it tells you nothing about whether someone already came through. Treat the Windows and Office estates as compromise-assessment scope, not just a patch target.
The month's highest score is a passenger. CVE-2026-21531, a 9.8 unauthenticated RCE in the Azure SDK for Python, is not being exploited and is a developer-library update (pip), not a Windows package — it does not set the deployment order.
Why now. Five separate flaws in this one cumulative were exploited in the wild before the patch shipped and were added to CISA KEV on release day: a Windows Shell security-feature bypass (CVE-2026-21510), an MSHTML bypass (CVE-2026-21513), a Desktop Window Manager elevation of privilege (CVE-2026-21519), a RAS Connection Manager denial of service (CVE-2026-21525) and a Remote Desktop Services elevation to SYSTEM (CVE-2026-21533). The exploitation signal alone makes this an emergency change; no structural argument is needed.
| Product | Package | Carries |
|---|---|---|
| Windows 11 25H2 / 24H2 | KB5077181 | CVE-2026-21510, CVE-2026-21513, CVE-2026-21519, CVE-2026-21525, CVE-2026-21533 |
| Windows 11 23H2 | KB5075941 | CVE-2026-21510, CVE-2026-21513, CVE-2026-21519, CVE-2026-21525, CVE-2026-21533 |
| Windows 10 22H2 (ESU) | KB5075912 | CVE-2026-21510, CVE-2026-21513, CVE-2026-21519, CVE-2026-21525, CVE-2026-21533 |
| Windows Server 2025 | KB5075899 | CVE-2026-21510, CVE-2026-21519, CVE-2026-21525, CVE-2026-21533 |
| Windows Server 2022 | KB5075906 | CVE-2026-21510, CVE-2026-21519, CVE-2026-21525, CVE-2026-21533 |
| Windows Server 2019 | KB5075904 | CVE-2026-21510, CVE-2026-21519, CVE-2026-21525, CVE-2026-21533 |
| Windows Server 2016 | KB5075999 | CVE-2026-21510, CVE-2026-21519, CVE-2026-21533 |
Also inside: ZDI notes CVE-2026-21519 is the second consecutive month a Desktop Window Manager elevation of privilege has been exploited, which suggests the January fix in the same component was incomplete — do not assume the January cumulative closed this class.
Patching is not remediation. All five were exploited as zero-days, so deployment and compromise assessment are two separate obligations and this unit discharges only the first. The bypasses (Shell, MSHTML) are typically reached by getting a user to open crafted content, and the elevation flaws (DWM, RDS) take an attacker who already has a foothold to SYSTEM — so review endpoints that opened untrusted documents or web content in the exposure window, and treat Remote Desktop hosts as in scope for lateral-movement review.
Then. Deploy the per-product package for your build from the table and reboot. Server 2025 is a distinct package (KB5075899) from the client 24H2 (KB5077181) despite sharing the 26100 base; a Server 2025 Hotpatch (KB5075942) also shipped this month for eligible hosts.
There is no soft call on the tier here — five KEV-listed exploited flaws force Act by evidence, not by judgement. The only judgement is deployment order within the Act wave, and this unit leads it because it carries the most exploited flaws and the broadest estate.
Why now. CVE-2026-21514 is an exploited, KEV-listed OLE mitigation bypass in Word that was also publicly disclosed at release. It ships on the Office servicing path, not the Windows cumulative, so deploying the OS update does not fix it — the Office estate needs its own change.
| Product | Package | Carries |
|---|---|---|
| Microsoft Office (Click-to-Run and MSI) / Microsoft Word | not established | resolve via vendor advisory before deployment |
Patching is not remediation. Exploited before its fix existed. Review endpoints that opened untrusted Office documents in the exposure window; an OLE bypass is a document-borne foothold, so this overlaps the Windows Shell/MSHTML hunt above.
Then. Update Office (Click-to-Run auto-updates; MSI via WSUS/SCCM) and confirm the build for your channel. The specific per-channel KB is not established in this brief — resolve it against the Security Update Guide for your Office SKU before scheduling.
Marking this a separate Act unit rather than folding it into the OS wave rests on it being a distinct servicing path — if your Office deployment already tracks the OS cadence, it is the same change window; if not, it is a second change and must not be skipped.
February 2026 is a security-feature-bypass cluster: four of the six exploited zero-days are bypasses or document-borne (Shell, MSHTML, Word, plus the DWM/RDS escalations), pointing at a document-to-SYSTEM chain rather than isolated bugs.
Basis. The exploited set groups by capability: two Shell/MSHTML bypasses that run when a user opens crafted content, a Word OLE bypass in the same document-entry position, and two local elevations (DWM, RDS) that take that foothold to SYSTEM. Each is separately KEV-attested; the claim that they compose into an entry-to-SYSTEM pattern is inferred from the capability shapes, not attested by any advisory.
What would lower this. No advisory links these CVEs into a single named campaign; if the exploited uses turn out to be unrelated actors hitting different flaws, the cluster reading weakens to coincidence. The pattern is an argument for patching the whole cumulative at once, not a claim about one intrusion set.
Why now. It is not now. CVE-2026-21531 is the month's highest score — a 9.8 unauthenticated remote code execution via a malicious token — but it is a Python SDK library, remediated by upgrading the affected azure-* packages through pip, not by a Windows update. Microsoft rates it Exploitation Less Likely and it is not in KEV. It is neither exposed technology nor core infrastructure in the model, so it is a normal-cycle dependency bump, not a deployment-order item.
| Product | Package | Carries |
|---|---|---|
| Azure SDK for Python (azure-* packages) | not established | resolve via vendor advisory before deployment |
Then. Bump the affected azure-* package versions in your Python dependency manifests on the normal cycle and rebuild. Do not let the 9.8 pull it into the emergency wave ahead of the six exploited zero-days.
| Source | Admiralty | Used for |
|---|---|---|
| https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities | A1 | KEV read 2026-07-17 (catalogVersion 2026.07.16): all six exploited CVEs added 2026-02-10; CVE-2026-21531 and CVE-2026-21511 confirmed absent |
| https://www.zerodayinitiative.com/blog/2026/2/10/the-february-2026-security-up | B2 | Count (58/62), Critical (5); DWM second-consecutive-month exploitation note; Azure SDK 9.8 |
| https://www.tenable.com/blog/microsofts-february-2026-patch-tuesday-addresses- | B2 | Count (54) and Critical (2, scope outlier); exploited set incl. CVE-2026-21514; vuln-type split |
| https://www.bleepingcomputer.com/news/microsoft/microsoft-february-2026-patch- | B2 | Count (58), Critical (5); the six-zero-day set; per-version KB list |
| https://www.crowdstrike.com/en-us/blog/patch-tuesday-analysis-february-2026/ | B2 | Count (59), Critical (5); exploited set; vulnerability-type breakdown |
| https://www.rapid7.com/blog/post/em-patch-tuesday-february-2026/ | B2 | Count (55); Azure SDK CVE-2026-21531 9.8 corroboration |
| https://securityaffairs.com/187848/uncategorized/microsoft-patch-tuesday-secur | B3 | Count (58/62) and the six-actively-exploited-zero-day framing |
| https://support.microsoft.com/en-us/topic/february-10-2026-kb5077181-os-builds | A2 | Windows 11 25H2/24H2 package KB5077181 and build of record |