# Microsoft February 2026 patches critical remote code execution flaws

Published: 2026-02-10 · Severity: routine · Sectors: government-national, defense, technology, financial-services, healthcare, education, manufacturing
Canonical: https://vorant.io/reports/58ba24e5-4576-55fd-a904-45aa67bbc0d2/microsoft-february-2026-patches-critical-remote-code-execution-flaws

> Microsoft issued patches for critical remote code execution vulnerabilities across multiple products; no active exploitation reported.

Microsoft released a critical patch bundle on February 10, 2026 addressing remote code execution vulnerabilities across a wide range of products. The most severe vulnerabilities could allow an attacker to execute code with the privileges of the logged-on user, potentially leading to program installation, data manipulation, account creation, or full system compromise depending on user privilege levels. Affected products span core Windows components (kernel, HTTP.sys, LDAP, NTLM, Hyper-V, Remote Desktop), Office applications (Excel, Word, Outlook), Azure services (DevOps Server, IoT SDK, HDInsights, Arc, Front Door), developer tools (Visual Studio, GitHub Copilot, .NET), and Edge for Android. The advisory indicates no current reports of in-the-wild exploitation. Immediate patching is recommended, with defenders advised to apply updates after testing, implement vulnerability management processes, enforce least privilege, conduct vulnerability scanning, and segment network architecture.

## Detection guidance (public sample)

### Office Application Spawning Script Interpreter or LOLBin

ATT&CK: T1203

Word, Excel, PowerPoint or Outlook spawning a shell, script host or download LOLBin, the typical post-exploitation pattern of Office RCE bugs. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Office Application Spawning Script Interpreter or LOLBin
description: Detects Office applications (Word, Excel, PowerPoint, Outlook) spawning
  command shells, script hosts or download/execute LOLBins. This is the typical child-process
  pattern after client-side exploitation of Office RCE vulnerabilities or malicious
  documents. Generalises on the parent/child relation, not on specific CVEs or payloads.
tags:
- attack.execution
- attack.t1203
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
    - \WINWORD.EXE
    - \EXCEL.EXE
    - \POWERPNT.EXE
    - \OUTLOOK.EXE
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \wscript.exe
    - \cscript.exe
    - \mshta.exe
    - \regsvr32.exe
    - \certutil.exe
    - \bitsadmin.exe
  condition: selection
falsepositives:
- Legacy Office macros or add-ins in business workflows that shell out to cmd or PowerShell
- Document management or reporting plugins that launch helper scripts from Excel or
  Outlook
level: high
id: a084b024-ffc8-52d8-98c1-cf69e4c74442
status: experimental
author: Vorant
references:
- https://www.cisecurity.org/advisory/critical-patches-issued-for-microsoft-products-february-10-2026_2026-011
```

### IIS Worker Process Spawning Shell or Download Utility

ATT&CK: T1190

w3wp.exe spawning a command shell, script host or download LOLBin, indicating possible exploitation of a public-facing web application or web shell activity. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: IIS Worker Process Spawning Shell or Download Utility
description: Detects the IIS worker process (w3wp.exe) spawning command interpreters,
  script hosts or download LOLBins. This is a common outcome of exploiting a public-facing
  Windows web service or application, or of web shell use. Generalises on the parent/child
  relation rather than on any specific vulnerability.
tags:
- attack.initial-access
- attack.t1190
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \w3wp.exe
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \wscript.exe
    - \cscript.exe
    - \mshta.exe
    - \certutil.exe
    - \bitsadmin.exe
  condition: selection
falsepositives:
- Legacy IIS applications that intentionally invoke cmd.exe or PowerShell for administrative
  tasks
- Deployment or health-check scripts triggered through IIS-hosted management applications
level: high
id: 7de92201-88c7-56cd-985a-0d427006357a
status: experimental
author: Vorant
references:
- https://www.cisecurity.org/advisory/critical-patches-issued-for-microsoft-products-february-10-2026_2026-011
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisecurity.org/advisory/critical-patches-issued-for-microsoft-products-february-10-2026_2026-011

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/58ba24e5-4576-55fd-a904-45aa67bbc0d2/microsoft-february-2026-patches-critical-remote-code-execution-flaws.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup