# Hackers Hit Windows, Office with Critical Zero-Day Flaws
Microsoft has released a critical security update addressing 59 vulnerabilities, including six actively exploited zero-day flaws that have already been weaponized by threat actors in the wild. The February 2026 Patch Tuesday update includes five Critical-rated vulnerabilities and 52 Important-rated flaws, with the company warning that attackers are likely to accelerate exploitation efforts in the coming weeks[1][2].
The discovery of these actively exploited vulnerabilities has prompted urgent action from federal authorities. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added all six zero-days to its Known Exploited Vulnerabilities (KEV) catalog, requiring Federal Civilian Executive Branch agencies to apply the fixes by March 3, 2026[1]. Security experts warn that the timing of this patch wave represents a significant threat landscape shift, with multiple attack vectors now available to cybercriminals.
The Six Zero-Day Vulnerabilities Actively Exploited
Microsoft confirmed that six zero-day vulnerabilities have been exploited in the wild prior to patch availability, with three of them also publicly disclosed[2]. These vulnerabilities span multiple Windows components and Microsoft Office products, creating a complex patching scenario for enterprises.
CVE-2026-21510 is a Windows Shell security feature bypass that allows attackers to circumvent Windows SmartScreen and Shell warning dialogs by persuading victims to open a malicious shortcut or link file[2]. This flaw enables untrusted code to launch without expected protections, making it particularly dangerous for social engineering attacks.
CVE-2026-21519, a Desktop Window Manager elevation of privilege vulnerability, exploits a type confusion flaw to allow authenticated attackers to escalate privileges to SYSTEM level[3][7]. This is the second consecutive month that a Desktop Window Manager zero-day has been discovered and exploited, suggesting attackers may be systematically targeting this critical Windows component[6].
CVE-2026-21533 affects Windows Remote Desktop Services and allows local authenticated attackers with low privileges to escalate to SYSTEM access without any required user interaction[4]. Despite the "Remote" designation in its name, this is actually a local privilege escalation vulnerability that poses particular risk to systems running Remote Desktop Services[6].
CVE-2026-21514 is a Microsoft Word security feature bypass (CVSS score 5.5) that relies on untrusted inputs in security decisions[1][4]. Attackers can exploit this by convincing users to open malicious Word documents, potentially bypassing Word's defenses for embedded or active content[4].
CVE-2026-21525 is a denial-of-service vulnerability in the Windows Remote Access Connection Manager, the service responsible for maintaining VPN connections to corporate networks[3].
The sixth zero-day, CVE-2026-21513, represents an additional security feature bypass vulnerability that researchers have identified as particularly dangerous[9].
Impact on Enterprise Security and Privilege Escalation Risks
The vulnerability breakdown reveals a concerning pattern: 25 of the 59 patched flaws are classified as privilege escalation vulnerabilities, followed by 12 remote code execution (RCE) flaws[1]. Security experts emphasize that the local privilege escalation vulnerabilities pose an immediate threat to compromised systems.
"These are local privilege escalation vulnerabilities, which means an attacker must have already gained access to a vulnerable host," explains Kev Breen, senior director of cyber threat research at Immersive[1]. "This could occur through a malicious attachment, a remote code execution vulnerability, or lateral movement from another compromised system."
Once attackers gain initial access and exploit these privilege escalation flaws, the consequences become severe. "With SYSTEM level access, a threat actor could disable security tooling, deploy additional malware, or, in worst-case scenarios, access secrets or credentials that could lead to full domain compromise," Breen adds[1].
Cybersecurity vendor CrowdStrike, which reported CVE-2026-21533, noted that threat actors in possession of the exploit binaries will likely ramp up their efforts to use or sell them in the near term[1]. This suggests a rapid acceleration in exploitation activity across both criminal and nation-state threat actors.
Affected Products and Patching Complexity
The February patch wave affects nearly all major Microsoft components, creating a comprehensive but complex patching scenario for IT departments[2]. Affected products include:
- Windows client and server operating systems - Microsoft Office and Microsoft 365 applications - Azure services and Windows Defender - .NET, GitHub Copilot, Visual Studio, and Power BI - Internet Explorer, MSHTML, SmartScreen, and Windows Shell - Windows Secure Boot
The update also coincides with Microsoft rolling out updated Secure Boot certificates to replace the original 2011 certificates that will expire in late June 2026[1]. These new certificates will be installed through the regular monthly Windows update process without any additional action required from users.
Organizations running Remote Desktop Services face particular urgency, as CVE-2026-21533 specifically targets this widely-deployed component. Systems with Remote Desktop Services present represent "juicy targets for attackers to move laterally after an initial breach," according to security researchers[6].
Immediate Action Required for Federal Agencies and Enterprises
CISA's addition of all six vulnerabilities to its KEV catalog reflects the severity and active exploitation threat. Federal Civilian Executive Branch agencies must apply the fixes by March 3, 2026[1], establishing a clear deadline for critical infrastructure protection.
For enterprise organizations, security experts recommend prioritizing patches for the privilege escalation and security feature bypass vulnerabilities. The fact that three of the six zero-days were publicly disclosed prior to patch availability means threat actors have had time to develop and refine exploitation techniques[2].
The combination of Windows Shell bypasses, Office document exploits, and privilege escalation flaws creates a multi-stage attack chain that threat actors can leverage. Initial compromise through phishing with malicious Office documents or shortcut files can be followed by privilege escalation to gain full system control, making rapid patching essential.
Frequently Asked Questions
What makes these zero-day vulnerabilities different from regular security flaws?
Zero-day vulnerabilities are security flaws that have been exploited by attackers before the software vendor releases a patch[1][2]. These six vulnerabilities were actively weaponized in real-world attacks before Microsoft released fixes, giving threat actors a significant head start in exploitation compared to standard vulnerabilities discovered through responsible disclosure.
Why is CVE-2026-21519 particularly concerning?
CVE-2026-21519 is a Desktop Window Manager privilege escalation flaw that allows attackers to run code with SYSTEM privileges[3][6]. The concern is heightened because this is the second consecutive month a Desktop Window Manager zero-day has been exploited, suggesting attackers are systematically targeting this critical Windows component and may have discovered additional vulnerabilities in this area[6].
Can these vulnerabilities be exploited remotely, or do attackers need local access?
Most of these vulnerabilities require some form of user interaction or local access[4]. For example, CVE-2026-21514 (Word bypass) requires users to open a malicious document, while CVE-2026-21519 and CVE-2026-21533 (privilege escalation flaws) require attackers to already have access to a system[1]. However, attackers typically chain these vulnerabilities together—using remote code execution or phishing to gain initial access, then leveraging privilege escalation to achieve full system control.
What should organizations prioritize when patching these 59 vulnerabilities?
Organizations should prioritize the six zero-day vulnerabilities and the 25 privilege escalation flaws, particularly CVE-2026-21533 if they run Remote Desktop Services[1][2][6]. Federal agencies must patch by March 3, 2026[1], but all organizations should treat these as critical given active exploitation. Security feature bypass vulnerabilities in Windows Shell and Microsoft Office should also be prioritized due to their role in initial compromise scenarios.
How will the updated Secure Boot certificates affect Windows systems?
The new Secure Boot certificates replacing the 2011 certificates will be installed automatically through the regular monthly Windows update process without requiring any additional action from users[1]. This transition is necessary because the original certificates expire in late June 2026, and the new certificates ensure continued Secure Boot functionality for systems booting Windows.
Are there indicators that attackers are already selling these exploits?
CrowdStrike indicated that threat actors in possession of exploit binaries will likely ramp up their efforts to use or sell them in the near term[1]. This suggests that exploit code for these vulnerabilities may already be circulating in underground forums and dark web marketplaces, making rapid patching even more critical for organizations to prevent compromise.