February 2026 Patch Tuesday Analysis

Today’s Patch Tuesday Alert addresses Microsoft’s February 2026 Security Updates. The FIRE team is actively working on coverage for these vulnerabilities and expect to ship that coverage as soon as it is completed.

In-The-Wild & Disclosed CVEs

CVE-2026-21519

A type confusion vulnerability in the Desktop Window Manager could allow an authenticated attacker to elevate their permissions to SYSTEM. Microsoft has reported this vulnerability as Exploitation Detected.

CVE-2026-21533

Improper privilege management in Windows Remote Desktop Services could allow an authenticated attacker to elevate their permissions to SYSTEM. Microsoft has reported this vulnerability as Exploitation Detected.

CVE-2026-21513

One of three bypasses this month, this vulnerability in the MSHTML Framework could allow a malicious HTML or shortcut file to bypass prompts when executing a file, leading to potential code execution. Microsoft has reported this vulnerability as Exploitation Detected.

CVE-2026-21510

The second of three bypasses this month, this vulnerability comes from improper handling within Windows Shell components. A successful attack would allow an attacker to bypass Windows SmartScreen and Windows Shell security prompts, meaning that malicious content could be executed without a user knowing. Microsoft has reported this vulnerability as Exploitation Detected.

CVE-2026-21514

The third of three bypasses this month, this Microsoft Word vulnerability could allow a malicious Office file to bypass the OLE mitigations that protect users from vulnerable COM/OLE controls. Microsoft has reported this vulnerability as Exploitation Detected.

CVE-2026-21525

A null pointer dereference in Windows Remote Access Connection Manager could allow for a local denial of service. Microsoft has reported this vulnerability as Exploitation Detected.

CVE Breakdown by Tag

While historical Microsoft Security Bulletin groupings are gone, Microsoft vulnerabilities are tagged with an identifier. This list provides a breakdown of the CVEs on a per tag basis. Vulnerabilities are also color coded to aid with identifying key issues.

• Traditional Software
• Mobile Software
• Cloud or Cloud Adjacent
• Vulnerabilities that are being exploited or that have been disclosed will be highlighted

Other Information

At the time of publication, there were no new advisories included with the February Security Guidance.