---
title: CISA Flagged Six Microsoft Zero-Days as Actively Exploited Back in February — Check You've Patched
description: Six Microsoft zero-days added to CISA's KEV Catalog in February 2026 remain a live risk for anyone who skipped that Patch Tuesday.
canonical_url: https://codekeeper.co/ticker/cisa-adds-microsoft-zero-day-flaws-to-kev-catalog
---

# CISA Flagged Six Microsoft Zero-Days as Actively Exploited Back in February — Check You've Patched

Six Microsoft zero-days added to CISA's KEV Catalog in February 2026 remain a live risk for anyone who skipped that Patch Tuesday.

![Content Team](https://codekeeper.co/hubfs/_sized/Codekeeper_21_beeldmerkL-800.png)

By Content Team Jul 27, 2026

Share [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcisa-adds-microsoft-zero-day-flaws-to-kev-catalog%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcisa-adds-microsoft-zero-day-flaws-to-kev-catalog%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcisa-adds-microsoft-zero-day-flaws-to-kev-catalog%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcisa-adds-microsoft-zero-day-flaws-to-kev-catalog%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcisa-adds-microsoft-zero-day-flaws-to-kev-catalog%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcisa-adds-microsoft-zero-day-flaws-to-kev-catalog%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

ON THIS PAGE

### Want more insights like this?

Subscribe to our newsletter to get the latest software protection strategies delivered to your inbox.

By submitting your email, you consent to Codekeeper contacting you and agree to our [privacy policy](https://codekeeper.co/privacy-policy) .

CISA added six actively exploited Microsoft zero-days to its Known Exploited Vulnerabilities Catalog on 10 February 2026: CVE-2026-21510 (Windows Shell), CVE-2026-21513 (MSHTML), CVE-2026-21514 (Office Word), CVE-2026-21519 (Desktop Window Manager), CVE-2026-21525 (Remote Access Connection Manager) and CVE-2026-21533 (Remote Desktop Services). Between them they cover privilege escalation, security feature bypasses and denial of service. Microsoft shipped fixes in its February 2026 Patch Tuesday, so anyone current on updates is covered — the risk sits with organisations that deferred that cycle. Federal remediation deadlines have since changed. CISA replaced Binding Operational Directive 22-01 with BOD 26-04 on 10 June 2026, swapping flat timelines for a tiered model running from three days to 60 days depending on risk. Nation-state groups, including China's Salt Typhoon, are among those exploiting similar flaws. All organisations should confirm the February patches are applied and audit exposure across Office, RDS and remote access tools. Source: [Cybersecurity News](https://cybersecuritynews.com/microsoft-0-day-vulnerabilities/)

Share this article [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcisa-adds-microsoft-zero-day-flaws-to-kev-catalog%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcisa-adds-microsoft-zero-day-flaws-to-kev-catalog%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcisa-adds-microsoft-zero-day-flaws-to-kev-catalog%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcisa-adds-microsoft-zero-day-flaws-to-kev-catalog%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcisa-adds-microsoft-zero-day-flaws-to-kev-catalog%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fcisa-adds-microsoft-zero-day-flaws-to-kev-catalog%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

![blog_book_a_demo_cta_3x](https://codekeeper.co/hubfs/_sized/Codekeeper%202025/blog_book_a_demo_cta_3x-768x512.webp)

Have questions about protecting your software?

Our escrow experts are standing by to help.

[Book a free demo](https://codekeeper.co/book-a-demo)

YOU MAY ALSO LIKE

[Software security Attackers Are Exploiting a Maximum-Severity Cisco ISE Flaw Sep 21, 2026](https://codekeeper.co/ticker/cisco-patches-critical-ise-vulnerability)

[GitHub's npm Gets Security Overhaul to Block Supply Chain Attacks Aug 12, 2026](https://codekeeper.co/ticker/github-npm-v12-security-update)

[Cyberattacks Critical Fortinet FortiMail Zero-Day Under Active Attack Oct 2, 2026](https://codekeeper.co/ticker/fortimail-zero-day-vulnerability-cve-2026-104286)

[North Korea's Lazarus Group Exploits Windows Kernel Zero-Day to Deploy Upgraded Rootkit Aug 12, 2026](https://codekeeper.co/ticker/north-korea-lazarus-zero-day-exploit)