Microsoft February Patch Tuesday Fixes Actively Exploited Zero-Days Including Windows RDS Privilege Escalation

Microsoft’s February 2026 Patch Tuesday shipped fixes for 58 vulnerabilities across Windows, Office, and related components, including six zero-days reported as actively exploited. Reported zero-days included CVE-2026-21533 (Windows Remote Desktop Services elevation of privilege), CVE-2026-21510 (Windows Shell security feature bypass involving SmartScreen/Mark-of-the-Web), CVE-2026-21513 and CVE-2026-21514 (Office/MSHTML mitigation bypasses requiring user interaction), and CVE-2026-21525 (Windows Remote Access Connection Manager DoS). Coverage of the release emphasized that elevation-of-privilege issues were the largest category in the update set, and that organizations should prioritize rapid deployment given in-the-wild exploitation claims.

For CVE-2026-21533 (CVSS 7.8, Important), reporting cited CrowdStrike observations of an exploit binary used post-compromise to reach SYSTEM by modifying a service configuration registry key to point to attacker-controlled values, enabling actions such as adding a user to the local Administrators group; the issue primarily impacts Windows systems where RDS is enabled and is positioned as a strong enabler for lateral movement in RDP-heavy environments. Separately, a January 2026-patched local privilege escalation in Windows Error Reporting, CVE-2026-20817 (CVSS 7.8), was described with technical detail and a released PoC: the WER service (wersvc.dll) allegedly failed to validate requester permissions over ALPC, allowing a standard user to trigger process creation with a SYSTEM-derived token retaining powerful privileges (e.g., SeDebugPrivilege, SeImpersonatePrivilege, SeBackupPrivilege), underscoring the broader trend of Windows local EoP bugs being leveraged for post-exploitation escalation.