{"id":"microsoft-windows-word-exploited-flaws-feb-2026","category":"patch","status":"closed","title":"Microsoft patches six exploited Windows and Word flaws","tldr":"Six exploited flaws affect Windows and Microsoft Word. Malicious links or documents can bypass protections; other flaws help attackers already on a PC gain control. Install current Windows and Office updates, including Office updates on affected Macs.","summary":"Microsoft's 10 February updates addressed six vulnerabilities already being exploited: five in Windows and one in Word. Windows Shell and MSHTML flaws let malicious content bypass security protections. The Word flaw bypasses safeguards against unsafe embedded components when someone opens a malicious document; the Preview Pane is not an attack route. Desktop Window Manager and Remote Desktop flaws let attackers with an existing foothold gain higher privileges. The sixth flaw can stop Windows Remote Access Connection Manager locally; it is not itself a memory-corruption takeover flaw. CISA confirmed exploitation of all six. Akamai subsequently linked MSHTML exploitation to APT28 infrastructure, identifying a sample submitted before the patches. The affected products include Windows PCs, Windows Server and specified Microsoft 365 and Office editions, including Office LTSC for Mac. Fixes are available. As at 3 November, the sources reviewed do not establish the total number of victims or that attacks have ended.","action":"Install all available Windows updates and restart, then update Office separately: in Word on Windows, choose File → Account → Update Options → Update Now; on Mac, choose Help → Check for Updates. Ask your IT provider to check managed computers and servers against Microsoft's February fixes, and to confirm that older Windows installations still receive security updates.","product":"Microsoft Windows, Windows Server and Microsoft Word","audience":"both","severity":"high","patch":"patched","exploited":true,"cves":["CVE-2026-21510","CVE-2026-21513","CVE-2026-21514","CVE-2026-21519","CVE-2026-21525","CVE-2026-21533"],"tags":["microsoft","windows","office","word","zero-day","actively-exploited"],"affected":["Windows 10 versions 1607, 1809, 21H2 and 22H2 before their applicable February 2026 security builds.","Windows 11 versions 23H2, 24H2, 25H2 and 26H1 before their applicable fixed builds; affected versions vary by CVE.","Windows Server, including affected Windows Server 2016, 2019, 2022, 2022 23H2 and 2025 editions and listed Server Core installations; applicability varies by CVE.","Microsoft 365 Apps for Enterprise before the applicable Office security update for its servicing channel.","Microsoft Office LTSC 2021 and Microsoft Office LTSC 2024 before their applicable February 2026 security updates.","Microsoft Office LTSC for Mac 2021 and 2024 before 16.106.26020821."],"fixed":["Windows 10 1607: 10.0.14393.8868","Windows 10 1809: 10.0.17763.8389","Windows 10 21H2: 10.0.19044.6937","Windows 10 22H2: 10.0.19045.6937","Windows 11 23H2: 10.0.22631.6649","Windows 11 24H2: 10.0.26100.7840","Windows 11 25H2: 10.0.26200.7840","Windows 11 26H1: 10.0.28000.1575 for CVE-2026-21519","Windows Server: install the applicable February 2026 security update or a superseding cumulative update for each affected edition.","Microsoft 365 Current Channel: 2601, build 19628.20204","Microsoft 365 Monthly Enterprise Channel: 2512 build 19530.20226; 2511 build 19426.20294; 2510 build 19328.20306","Microsoft 365 Semi-Annual Enterprise Channel: 2508 build 19127.20532; 2502 build 18526.20714; 2408 build 17928.20776","Office 2021 and Office 2024 Retail: 2601, build 19628.20204","Office LTSC 2021 Volume Licensed: 2108, build 14334.20522","Office LTSC 2024 Volume Licensed: 2408, build 17932.20670","Office LTSC for Mac 2021 and 2024: 16.106.26020821"],"matches":[{"platform":"windows","app":"Windows 10 Version 1607","bundle":"","fixed":"10.0.14393.8868"},{"platform":"windows","app":"Windows 10 Version 1809","bundle":"","fixed":"10.0.17763.8389"},{"platform":"windows","app":"Windows 10 Version 21H2","bundle":"","fixed":"10.0.19044.6937"},{"platform":"windows","app":"Windows 10 Version 22H2","bundle":"","fixed":"10.0.19045.6937"},{"platform":"windows","app":"Windows 11 Version 23H2","bundle":"","fixed":"10.0.22631.6649"},{"platform":"windows","app":"Windows 11 Version 24H2","bundle":"","fixed":"10.0.26100.7840"},{"platform":"windows","app":"Windows 11 Version 25H2","bundle":"","fixed":"10.0.26200.7840"},{"platform":"windows","app":"Windows 11 Version 26H1","bundle":"","fixed":"10.0.28000.1575"},{"platform":"macos","app":"Microsoft Word (Office LTSC 2021 or 2024)","bundle":"com.microsoft.Word","fixed":"16.106.26020821"},{"platform":"windows","app":"Microsoft Word (Office 2021 or 2024 Retail)","bundle":"","fixed":"16.0.19628.20204"}],"sources":[{"kind":"advisory","title":"February 2026 Security Updates","url":"https://msrc.microsoft.com/update-guide/releaseNote/2026-Feb","by":"Microsoft","date":"2026-02-10"},{"kind":"advisory","title":"Release notes for Microsoft Office security updates — February 10, 2026","url":"https://learn.microsoft.com/en-us/officeupdates/microsoft365-apps-security-updates","by":"Microsoft","date":"2026-02-10"},{"kind":"advisory","title":"CVE-2026-21514 — Microsoft-supplied affected products","url":"https://nvd.nist.gov/vuln/detail/cve-2026-21514","by":"NIST NVD / Microsoft","date":"2026-02-10"},{"kind":"advisory","title":"CVE-2026-21519 — Microsoft-supplied affected products and fixed-build boundaries","url":"https://nvd.nist.gov/vuln/detail/cve-2026-21519","by":"NIST NVD / Microsoft","date":"2026-02-10"},{"kind":"advisory","title":"CISA Adds Six Known Exploited Vulnerabilities to Catalog","url":"https://content.govdelivery.com/accounts/USDHSCISA/bulletins/4093c1e","by":"CISA","date":"2026-02-10"},{"kind":"news","title":"Microsoft February 2026 Patch Tuesday fixes 6 zero-days, 58 flaws","url":"https://www.bleepingcomputer.com/news/microsoft/microsoft-february-2026-patch-tuesday-fixes-6-zero-days-58-flaws/","by":"BleepingComputer","date":"2026-02-10"},{"kind":"research","title":"The February 2026 Security Update Review","url":"https://www.zerodayinitiative.com/blog/2026/2/10/the-february-2026-security-update-review","by":"Zero Day Initiative","date":"2026-02-10"},{"kind":"research","title":"Inside the Fix: Analysis of In-the-Wild Exploit of CVE-2026-21513","url":"https://www.akamai.com/blog/security-research/2026/feb/inside-the-fix-cve-2026-21513-mshtml-exploit-analysis","by":"Akamai","date":"2026-02-20"}],"started":"2026-02-10","closed":"2026-02-20","created":"2026-11-03T20:51:50.552Z","updated":"2026-11-03T20:51:50.552Z","cve_notes":[{"cve":"CVE-2026-21510","name":"Security-warning bypass in Windows Shell","what":"A protection failure in Windows Shell lets a malicious link or shortcut bypass Windows security prompts when someone opens it.","severity":"high","cvss":8.8},{"cve":"CVE-2026-21513","name":"Security-protection bypass in Windows MSHTML","what":"A protection failure in Windows' MSHTML web-content component lets malicious content bypass security boundaries and potentially run attacker-controlled files.","severity":"high","cvss":8.8},{"cve":"CVE-2026-21514","name":"Unsafe embedded-component protection bypass in Word","what":"Word trusts unsafe input when making a security decision, allowing a malicious document that someone opens to bypass protections against dangerous embedded components.","severity":"high","cvss":7.8},{"cve":"CVE-2026-21519","name":"Privilege escalation in Desktop Window Manager","what":"A type-confusion flaw in Windows Desktop Window Manager lets an attacker already running with limited permissions gain SYSTEM privileges.","severity":"high","cvss":7.8},{"cve":"CVE-2026-21525","name":"Local service disruption in Windows connection manager","what":"A null-pointer flaw in Windows Remote Access Connection Manager lets a local attacker make the service unavailable.","severity":"medium","cvss":6.2},{"cve":"CVE-2026-21533","name":"Local privilege escalation in Windows Remote Desktop","what":"Incorrect permission management in Windows Remote Desktop lets an attacker with an existing local foothold gain higher privileges.","severity":"high","cvss":7.8}],"timeline":[{"at":"2026-02-20","added":"2026-11-03T20:32:12.437Z","kind":"other","text":"Akamai published its analysis linking observed MSHTML exploitation to APT28 infrastructure. It said Microsoft's February updates fully address CVE-2026-21513.","url":"https://www.akamai.com/blog/security-research/2026/feb/inside-the-fix-cve-2026-21513-mshtml-exploit-analysis","by":"Akamai","patch":null},{"at":"2026-02-10T21:00Z","added":"2026-11-03T20:32:12.437Z","kind":"cisa-added","text":"CISA added all six CVEs to its Known Exploited Vulnerabilities catalogue, citing evidence of active exploitation.","url":"https://content.govdelivery.com/accounts/USDHSCISA/bulletins/4093c1e","by":"CISA","patch":null},{"at":"2026-02-10","added":"2026-11-03T20:32:12.437Z","kind":"new-fix","text":"Microsoft released February security updates addressing six exploited flaws: five in Windows and one in Word. They cover three security-protection bypasses, two local privilege-escalation flaws and one local denial-of-service flaw.","url":"https://msrc.microsoft.com/update-guide/releaseNote/2026-Feb","by":"Microsoft","patch":"patched"},{"at":"2026-01-30","added":"2026-11-03T20:32:12.437Z","kind":"other","text":"A malicious sample using CVE-2026-21513 was submitted to VirusTotal. Akamai later associated it with infrastructure linked to the Russian state-sponsored group APT28; this does not establish when attacks began.","url":"https://www.akamai.com/blog/security-research/2026/feb/inside-the-fix-cve-2026-21513-mshtml-exploit-analysis","by":"Akamai","patch":"none"}],"url":"https://hard.fyi/live/microsoft-windows-word-exploited-flaws-feb-2026/","json":"https://hard.fyi/api/live?id=microsoft-windows-word-exploited-flaws-feb-2026"}