Microsoft patches six exploited Windows and Word flaws
Six exploited flaws affect Windows and Microsoft Word. Malicious links or documents can bypass protections; other flaws help attackers already on a PC gain control. Install current Windows and Office updates, including Office updates on affected Macs.
Install all available Windows updates and restart, then update Office separately: in Word on Windows, choose File → Account → Update Options → Update Now; on Mac, choose Help → Check for Updates. Ask your IT provider to check managed computers and servers against Microsoft's February fixes, and to confirm that older Windows installations still receive security updates.
- Windows 10 Version 1607fixed in 10.0.14393.8868 and later
- Windows 10 Version 1809fixed in 10.0.17763.8389 and later
- Windows 10 Version 21H2fixed in 10.0.19044.6937 and later
- Windows 10 Version 22H2fixed in 10.0.19045.6937 and later
- Windows 11 Version 23H2fixed in 10.0.22631.6649 and later
- Windows 11 Version 24H2fixed in 10.0.26100.7840 and later
- Windows 11 Version 25H2fixed in 10.0.26200.7840 and later
- Windows 11 Version 26H1fixed in 10.0.28000.1575 and later
- Microsoft Word (Office LTSC 2021 or 2024)fixed in 16.106.26020821 and later
- Microsoft Word (Office 2021 or 2024 Retail)fixed in 16.0.19628.20204 and later
What’s happening
Microsoft's 10 February updates addressed six vulnerabilities already being exploited: five in Windows and one in Word. Windows Shell and MSHTML flaws let malicious content bypass security protections. The Word flaw bypasses safeguards against unsafe embedded components when someone opens a malicious document; the Preview Pane is not an attack route. Desktop Window Manager and Remote Desktop flaws let attackers with an existing foothold gain higher privileges. The sixth flaw can stop Windows Remote Access Connection Manager locally; it is not itself a memory-corruption takeover flaw. CISA confirmed exploitation of all six. Akamai subsequently linked MSHTML exploitation to APT28 infrastructure, identifying a sample submitted before the patches. The affected products include Windows PCs, Windows Server and specified Microsoft 365 and Office editions, including Office LTSC for Mac. Fixes are available. As at 3 November, the sources reviewed do not establish the total number of victims or that attacks have ended.
- What
- Flaw
- Affects
- Microsoft Windows, Windows Server and Microsoft Word
- Affected
- Windows 10 versions 1607, 1809, 21H2 and 22H2 before their applicable February 2026 security builds.
Windows 11 versions 23H2, 24H2, 25H2 and 26H1 before their applicable fixed builds; affected versions vary by CVE.
Windows Server, including affected Windows Server 2016, 2019, 2022, 2022 23H2 and 2025 editions and listed Server Core installations; applicability varies by CVE.
Microsoft 365 Apps for Enterprise before the applicable Office security update for its servicing channel.
Microsoft Office LTSC 2021 and Microsoft Office LTSC 2024 before their applicable February 2026 security updates.
Microsoft Office LTSC for Mac 2021 and 2024 before 16.106.26020821. - Fixed in
- Windows 10 1607: 10.0.14393.8868
Windows 10 1809: 10.0.17763.8389
Windows 10 21H2: 10.0.19044.6937
Windows 10 22H2: 10.0.19045.6937
Windows 11 23H2: 10.0.22631.6649
Windows 11 24H2: 10.0.26100.7840
Windows 11 25H2: 10.0.26200.7840
Windows 11 26H1: 10.0.28000.1575 for CVE-2026-21519
Windows Server: install the applicable February 2026 security update or a superseding cumulative update for each affected edition.
Microsoft 365 Current Channel: 2601, build 19628.20204
Microsoft 365 Monthly Enterprise Channel: 2512 build 19530.20226; 2511 build 19426.20294; 2510 build 19328.20306
Microsoft 365 Semi-Annual Enterprise Channel: 2508 build 19127.20532; 2502 build 18526.20714; 2408 build 17928.20776
Office 2021 and Office 2024 Retail: 2601, build 19628.20204
Office LTSC 2021 Volume Licensed: 2108, build 14334.20522
Office LTSC 2024 Volume Licensed: 2408, build 17932.20670
Office LTSC for Mac 2021 and 2024: 16.106.26020821 - Since
- 10 Feb 2026
- Closed
- 20 Feb 2026
Timeline
- Update
Akamai published its analysis linking observed MSHTML exploitation to APT28 infrastructure. It said Microsoft's February updates fully address CVE-2026-21513.
- CISA added
CISA added all six CVEs to its Known Exploited Vulnerabilities catalogue, citing evidence of active exploitation.
- New fixFixed
Microsoft released February security updates addressing six exploited flaws: five in Windows and one in Word. They cover three security-protection bypasses, two local privilege-escalation flaws and one local denial-of-service flaw.
- UpdateNo fix yet
A malicious sample using CVE-2026-21513 was submitted to VirusTotal. Akamai later associated it with infrastructure linked to the Russian state-sponsored group APT28; this does not establish when attacks began.
Sources
- February 2026 Security UpdatesMicrosoft · 10 Feb 2026
- Release notes for Microsoft Office security updates — February 10, 2026Microsoft · 10 Feb 2026
- CVE-2026-21514 — Microsoft-supplied affected productsNIST NVD / Microsoft · 10 Feb 2026
- CVE-2026-21519 — Microsoft-supplied affected products and fixed-build boundariesNIST NVD / Microsoft · 10 Feb 2026
- CISA Adds Six Known Exploited Vulnerabilities to CatalogCISA · 10 Feb 2026
- Microsoft February 2026 Patch Tuesday fixes 6 zero-days, 58 flawsBleepingComputer · 10 Feb 2026
- The February 2026 Security Update ReviewZero Day Initiative · 10 Feb 2026
- Inside the Fix: Analysis of In-the-Wild Exploit of CVE-2026-21513Akamai · 20 Feb 2026