Microsoft addresses 61 vulnerabilities, with active exploitation of MSHTML and RDP components reported globally.
What This Patch Tuesday Actually Covers
Microsoft’s February 2026 Patch Tuesday release addresses 61 vulnerabilities, including six zero-days. Two of those families matter immediately for operations teams: MSHTML and Remote Desktop Protocol (RDP). Both are reported under active exploitation worldwide, which means the usual “patch during the next maintenance window” default is too slow for exposed systems.
A zero-day in this context is a flaw that was already being used before a fix shipped. That shifts priority from risk scoring alone to exposure: if attackers can reach the component, assume they may already be probing it. Treat the RDP and MSHTML fixes as emergency work, then fold the remaining updates into a structured rollout for servers, workstations, and managed images.
Why MSHTML and RDP Are High-Impact Targets
MSHTML is the legacy rendering engine still pulled into Office documents, certain browsers, and other Windows components that parse web-like content. Exploitation often starts with a crafted file or link that triggers the engine without a full “open this untrusted app” decision. Users may never consciously launch a browser; the payload rides on something they already open every day.
RDP is different: it is a remote control surface. When RDP is reachable from the internet, or weakly protected on internal networks, a remote code execution or authentication bypass path becomes a direct path to a shell. Combined with active exploitation, that turns every publicly exposed RDP endpoint into an incident-response candidate, not just a patch ticket. Even internal RDP deserves attention—lateral movement after an initial foothold commonly reuses remote desktop sessions.
Practical Response Order for Security and IT Teams
Work the problem in layers rather than waiting for a single “fully patched” state. Prioritize systems that can be reached without prior authentication, then high-value hosts, then the long tail of endpoints.
- Inventory internet-facing RDP and any jump hosts; disable public RDP where it is not required, and enforce network-level controls plus multi-factor authentication on what remains.
- Deploy the Microsoft updates for RDP and MSHTML first on those exposed and high-value systems, then cascade to the rest of the estate.
- Block or heavily restrict legacy document and preview handlers that still invoke MSHTML where business process allows.
- Hunt for anomalous RDP logons, new local accounts, and unexpected processes on systems that were reachable before the patch landed.
- Confirm backup and recovery paths for critical servers before mass reboots so a failed update does not become a second outage.
Do not treat “rebooted after update” as the end of the story. Verify the relevant packages or KBs actually installed, re-check open ports, and ensure golden images and VDI templates receive the same fixes so newly provisioned machines do not reintroduce the hole.
Hardening Beyond the Hotfixes
Patches close known bugs; they do not fix weak architecture. Remote desktop should sit behind a VPN, zero-trust access gateway, or bastion that authenticates the user before any RDP port is exposed. Prefer just-in-time access over always-on admin sessions. For document-driven MSHTML risk, reduce attack surface by limiting macros, isolating preview panes, and routing untrusted attachments through sandbox detonation where you have that capability.
Communicate clearly to help desks and users: unexpected remote session prompts, document warnings, or forced restarts after this cycle are expected, not optional. The six zero-days and the broader set of 61 fixes are a single coordinated release—miss one high-severity component and the rest of the bundle buys you little. Patch the exposed RDP and MSHTML surfaces first, then finish the full February 2026 set with the same discipline you would apply to any crisis-driven maintenance window.