CVE-2026-21513

8.8

HIGH CVSS 3.1

Microsoft MSHTML Framework Protection Mechanism Failure Vulnerability - [Actively Exploited]

Description

Protection mechanism failure in MSHTML Framework allows an unauthorized attacker to bypass a security feature over a network.

INFO

Published Date :

Feb. 10, 2026, 6:16 p.m.

Last Modified :

Feb. 11, 2026, 3:38 p.m.

Remotely Exploit :

Yes !

Source :

[email protected]

CISA Notification

CISA KEV (Known Exploited Vulnerabilities)

For the benefit of the cybersecurity community and network defenders—and to help every organization better manage vulnerabilities and keep pace with threat activity—CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild.

Due Date: Mar 03, 2026

Alert Date: Feb 10, 2026 | 20 days ago

Description :

Microsoft MSHTML Framework contains a protection mechanism failure vulnerability that could allow an unauthorized attacker to bypass a security feature over a network.

Required Action :

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Known Ransomware Campaign Use:

Unknown

Notes :

https://msrc.microsoft.com/update-guide/advisory/CVE-2026-21513 ; https://nvd.nist.gov/vuln/detail/CVE-2026-21513

Affected Products

The following products are affected by CVE-2026-21513 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID	Vendor	Product
1	Microsoft	windows_server_2012
2	Microsoft	windows_server_2016
3	Microsoft	windows_server_2019
4	Microsoft	windows_10_1607
5	Microsoft	windows_10_1809
6	Microsoft	windows_10_21h2
7	Microsoft	windows_10_22h2
8	Microsoft	windows_server_2022
9	Microsoft	windows_11_23h2
10	Microsoft	windows_server_2022_23h2
11	Microsoft	windows_server_23h2
12	Microsoft	windows_server_2012_r2
13	Microsoft	windows_11_24h2
14	Microsoft	windows_server_2025
15	Microsoft	windows_11_25h2
16	Microsoft	windows_11_26h1

: Total Affected Vendor : 1 | Products : 16

CVSS Scores

The Common Vulnerability Scoring System is a standardized framework for assessing the severity of vulnerabilities in software and systems. We collect and displays CVSS scores from various sources for each CVE.

Score	Version	Severity	Vector	Exploitability Score	Impact Score	Source
	CVSS 3.1	HIGH				[email protected]

Solution

Apply security updates to address MSHTML Framework protection mechanism failures and prevent unauthorized access.

Install MSHTML Framework security updates.
Review and enforce access controls.
Monitor network for suspicious activity.

Public PoC/Exploit Available at Github

CVE-2026-21513 has a 3 public PoC/Exploit available at Github. Go to the Public Exploits tab to see the list.

References to Advisories, Solutions, and Tools

Here, you will find a curated list of external links that provide in-depth information, practical solutions, and valuable tools related to CVE-2026-21513.

URL	Resource
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21513	Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-21513	US Government Resource

CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2026-21513 is associated with the following CWEs:

CWE-693: Protection Mechanism Failure

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2026-21513 weaknesses.

CAPEC-1: Accessing Functionality Not Properly Constrained by ACLs Accessing Functionality Not Properly Constrained by ACLs CAPEC-17: Using Malicious Files Using Malicious Files CAPEC-20: Encryption Brute Forcing Encryption Brute Forcing CAPEC-22: Exploiting Trust in Client Exploiting Trust in Client CAPEC-36: Using Unpublished Interfaces or Functionality Using Unpublished Interfaces or Functionality CAPEC-51: Poison Web Service Registry Poison Web Service Registry CAPEC-57: Utilizing REST's Trust in the System Resource to Obtain Sensitive Data Utilizing REST's Trust in the System Resource to Obtain Sensitive Data CAPEC-59: Session Credential Falsification through Prediction Session Credential Falsification through Prediction CAPEC-65: Sniff Application Code Sniff Application Code CAPEC-74: Manipulating State Manipulating State CAPEC-87: Forceful Browsing Forceful Browsing CAPEC-107: Cross Site Tracing Cross Site Tracing CAPEC-127: Directory Indexing Directory Indexing CAPEC-237: Escaping a Sandbox by Calling Code in Another Language Escaping a Sandbox by Calling Code in Another Language CAPEC-477: Signature Spoofing by Mixing Signed and Unsigned Content Signature Spoofing by Mixing Signed and Unsigned Content CAPEC-480: Escaping Virtualization Escaping Virtualization CAPEC-668: Key Negotiation of Bluetooth Attack (KNOB) Key Negotiation of Bluetooth Attack (KNOB)

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

kapetanios55/SentinelCBContent

None

Shell Python

Updated: 4 days, 15 hours ago

0 stars 0 fork 0 watcher

Born at : Feb. 20, 2026, 10:40 p.m. This repo has been linked 23 different CVEs too.

greenido/CISA-alerts-bot

A stateless GitHub Action that monitors Cybersecurity Alerts and sends structured alerts to Slack / Telegram

TypeScript

Updated: 2 weeks, 3 days ago

0 stars 0 fork 0 watcher

Born at : Feb. 13, 2026, 4:10 a.m. This repo has been linked 6 different CVEs too.

ekomsSavior/Cerberus

Cerberus-CVE Assessment Situation

Python

Updated: 1 week, 6 days ago

13 stars 5 fork 5 watcher

Born at : Nov. 3, 2025, 7:46 p.m. This repo has been linked 6 different CVEs too.

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2026-21513 vulnerability anywhere in the article.

CybersecurityNews

MSHTML Framework 0-Day Exploited by APT28 Hackers Before Feb 2026’s Patch Tuesday Update

MSHTML Framework 0-Day Exploited by APT28 A zero-day vulnerability in the Microsoft HTML (MSHTML) framework was actively exploited in the wild. The vulnerability, tracked as CVE-2026-21513, allows att ...

Published Date: Mar 02, 2026 (7 hours, 1 minute ago)

The Hacker News

APT28 Tied to CVE-2026-21513 MSHTML 0-Day Exploited Before Feb 2026 Patch Tuesday

A recently disclosed security flaw patched by Microsoft may have been exploited by the Russia-linked state-sponsored threat actor known as APT28, according to new findings from Akamai. The vulnerabili ...

Published Date: Mar 02, 2026 (12 hours, 32 minutes ago)

The Hacker News

Weekly Recap: Outlook Add-Ins Hijack, 0-Day Patches, Wormable Botnet & AI Malware

This week’s recap shows how small gaps are turning into big entry points. Not always through new exploits, often through tools, add-ons, cloud setups, or workflows that people already trust and rarely ...

Published Date: Feb 16, 2026 (2 weeks ago)

CybersecurityNews

MSHTML Framework 0-Day Vulnerability Let Attackers Security Feature over Network

MSHTML Framework 0-Day Vulnerability Microsoft has released an urgent security patch for a critical zero-day vulnerability (CVE-2026-21513) affecting the MSHTML Framework, which was actively exploited ...