Microsoft February 2026 patches critical remote code execution flaws
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Microsoft issued patches for critical remote code execution vulnerabilities across multiple products; no active exploitation reported.
Microsoft released a critical patch bundle on February 10, 2026 addressing remote code execution vulnerabilities across a wide range of products. The most severe vulnerabilities could allow an attacker to execute code with the privileges of the logged-on user, potentially leading to program installation, data manipulation, account creation, or full system compromise depending on user privilege levels. Affected products span core Windows components (kernel, HTTP.sys, LDAP, NTLM, Hyper-V, Remote Desktop), Office applications (Excel, Word, Outlook), Azure services (DevOps Server, IoT SDK, HDInsights, Arc, Front Door), developer tools (Visual Studio, GitHub Copilot, .NET), and Edge for Android. The advisory indicates no current reports of in-the-wild exploitation. Immediate patching is recommended, with defenders advised to apply updates after testing, implement vulnerability management processes, enforce least privilege, conduct vulnerability scanning, and segment network architecture.
Detection guidance
Office Application Spawning Script Interpreter or LOLBin
Word, Excel, PowerPoint or Outlook spawning a shell, script host or download LOLBin, the typical post-exploitation pattern of Office RCE bugs. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Office Application Spawning Script Interpreter or LOLBin
description: Detects Office applications (Word, Excel, PowerPoint, Outlook) spawning
command shells, script hosts or download/execute LOLBins. This is the typical child-process
pattern after client-side exploitation of Office RCE vulnerabilities or malicious
documents. Generalises on the parent/child relation, not on specific CVEs or payloads.
tags:
- attack.execution
- attack.t1203
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith:
- \WINWORD.EXE
- \EXCEL.EXE
- \POWERPNT.EXE
- \OUTLOOK.EXE
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \wscript.exe
- \cscript.exe
- \mshta.exe
- \regsvr32.exe
- \certutil.exe
- \bitsadmin.exe
condition: selection
falsepositives:
- Legacy Office macros or add-ins in business workflows that shell out to cmd or PowerShell
- Document management or reporting plugins that launch helper scripts from Excel or
Outlook
level: high
id: a084b024-ffc8-52d8-98c1-cf69e4c74442
status: experimental
author: Vorant
references:
- https://www.cisecurity.org/advisory/critical-patches-issued-for-microsoft-products-february-10-2026_2026-011
IIS Worker Process Spawning Shell or Download Utility
w3wp.exe spawning a command shell, script host or download LOLBin, indicating possible exploitation of a public-facing web application or web shell activity. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: IIS Worker Process Spawning Shell or Download Utility
description: Detects the IIS worker process (w3wp.exe) spawning command interpreters,
script hosts or download LOLBins. This is a common outcome of exploiting a public-facing
Windows web service or application, or of web shell use. Generalises on the parent/child
relation rather than on any specific vulnerability.
tags:
- attack.initial-access
- attack.t1190
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith: \w3wp.exe
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \wscript.exe
- \cscript.exe
- \mshta.exe
- \certutil.exe
- \bitsadmin.exe
condition: selection
falsepositives:
- Legacy IIS applications that intentionally invoke cmd.exe or PowerShell for administrative
tasks
- Deployment or health-check scripts triggered through IIS-hosted management applications
level: high
id: 7de92201-88c7-56cd-985a-0d427006357a
status: experimental
author: Vorant
references:
- https://www.cisecurity.org/advisory/critical-patches-issued-for-microsoft-products-february-10-2026_2026-011
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisecurity.org/advisory/critical-patches-issued-for-microsoft-products-february-10-2026_2026-011
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs