Feb 2026 Patch Tuesday: 6 Zero-Days & The Remote Desktop Crisis

Sunday, February 22, 2026 — Microsoft's February 2026 security update is one of the most critical in recent years. Addressing 61 unique CVEs, the patch includes fixes for six zero-day vulnerabilities, three of which were publicly disclosed before the patch became available. Security teams should prioritize deployment immediately.

1. CVE-2026-21533: RDP Elevation of Privilege

The most dangerous flaw in this cycle is CVE-2026-21533 (CVSS 7.8), affecting Windows Remote Desktop Services. An authorized local attacker can exploit this to escalate to SYSTEM level access. Exploits have been observed in the wild since late December 2025, where attackers modify service configuration keys to add unauthorized users to the Local Administrator group.

2. CVE-2026-21513: MSHTML Security Bypass

Affecting the legacy MSHTML Framework (Trident), CVE-2026-21513 (CVSS 8.8) is a critical initial access vector. Attackers are sending malicious .lnk (shortcut) or .html files that, when opened, manipulate Windows Shell handling to execute code without triggering standard Mark of the Web (MoTW) or SmartScreen warnings.

Critical Vulnerability Matrix

CVE ID	Type	CVSS	Status
CVE-2026-21513	MSHTML Bypass	8.8	Exploited
CVE-2026-21510	Shell Bypass	8.8	Exploited
CVE-2026-21533	RDP Privilege	7.8	Exploited
CVE-2026-0488	SAP S/4HANA	9.9	Critical

3. The Adobe & SAP Cross-Platform Surge

Adobe also released critical updates for 44 CVEs across the Creative Cloud suite, with 27 rated as critical execution risks. Most notably, SAP issued a 9.9 CVSS fix for a code injection bug in SAP S/4HANA (CVE-2026-0488), highlighting that the threat landscape is currently targeting core business infrastructure.

Actionable Mitigation Steps

🛑 Restrict RDP Exposure: Ensure RDP is not exposed directly to the internet. Use VPN or Conditional Access with MFA.
🛡️ Deploy February Patches: Force update all Windows 10/11 and Server 2022/2025 endpoints immediately.
🚫 Block Suspicious Files: Update email filters to flag or block .lnk and standalone .html attachments from external senders.

The Verdict

The sheer volume of actively exploited zero-days in this Patch Tuesday cycle suggests a coordinated offensive against Windows and SAP ecosystems. Engineers must move beyond "Scheduled Patching" and embrace a **Vulnerability Management** mindset where zero-day alerts trigger emergency response protocols.

Secure Your Infrastructure 🛡️

Are your systems vulnerable to the latest RDP exploits? Get our **Zero-Day Vulnerability Scanning Script** and secure your fleet today.

Get Security Script Latest Security Feed

Sources: Microsoft Security Update Guide | Adobe Security Bulletins