CVE-2026-21513

8.8

HIGH CVSS 3.1

Microsoft MSHTML Framework Protection Mechanism Failure Vulnerability - [Actively Exploited]

Overview

Description

Protection mechanism failure in MSHTML Framework allows an unauthorized attacker to bypass a security feature over a network.

Details

INFO

Published Date :

Feb. 10, 2026, 6:16 p.m.

Last Modified :

Feb. 11, 2026, 3:38 p.m.

Remotely Exploit :

Yes !

Source :

[email protected]

CISA Notification

CISA KEV (Known Exploited Vulnerabilities)

For the benefit of the cybersecurity community and network defenders—and to help every organization better manage vulnerabilities and keep pace with threat activity—CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild.

Due Date: Mar 03, 2026

Alert Date: Feb 10, 2026 | 44 days ago

Description :

Microsoft MSHTML Framework contains a protection mechanism failure vulnerability that could allow an unauthorized attacker to bypass a security feature over a network.

Required Action :

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Known Ransomware Campaign Use:

Unknown

Notes :

https://msrc.microsoft.com/update-guide/advisory/CVE-2026-21513 ; https://nvd.nist.gov/vuln/detail/CVE-2026-21513

Impact

Affected Products

The following products are affected by CVE-2026-21513 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID	Vendor	Product
1	Microsoft	windows_server_2012
2	Microsoft	windows_server_2016
3	Microsoft	windows_server_2019
4	Microsoft	windows_10_1607
5	Microsoft	windows_10_1809
6	Microsoft	windows_10_21h2
7	Microsoft	windows_10_22h2
8	Microsoft	windows_server_2022
9	Microsoft	windows_11_23h2
10	Microsoft	windows_server_2022_23h2
11	Microsoft	windows_server_23h2
12	Microsoft	windows_server_2012_r2
13	Microsoft	windows_11_24h2
14	Microsoft	windows_server_2025
15	Microsoft	windows_11_25h2
16	Microsoft	windows_11_26h1

: Total Affected Vendor : 1 | Products : 16

Scoring

CVSS Scores

The Common Vulnerability Scoring System is a standardized framework for assessing the severity of vulnerabilities in software and systems. We collect and displays CVSS scores from various sources for each CVE.

Score	Version	Severity	Vector	Exploitability Score	Impact Score	Source
	CVSS 3.1	HIGH				[email protected]

Solution

Apply security updates to address MSHTML Framework protection mechanism failures and prevent unauthorized access.

Install MSHTML Framework security updates.
Review and enforce access controls.
Monitor network for suspicious activity.

Public PoC/Exploit Available at Github

CVE-2026-21513 has a 5 public PoC/Exploit available at Github. Go to the Public Exploits tab to see the list.

References

References to Advisories, Solutions, and Tools

Here, you will find a curated list of external links that provide in-depth information, practical solutions, and valuable tools related to CVE-2026-21513.

URL	Resource
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21513	Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-21513	US Government Resource

CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2026-21513 is associated with the following CWEs:

CWE-693: Protection Mechanism Failure

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2026-21513 weaknesses.

CAPEC-1: Accessing Functionality Not Properly Constrained by ACLs Accessing Functionality Not Properly Constrained by ACLs CAPEC-17: Using Malicious Files Using Malicious Files CAPEC-20: Encryption Brute Forcing Encryption Brute Forcing CAPEC-22: Exploiting Trust in Client Exploiting Trust in Client CAPEC-36: Using Unpublished Interfaces or Functionality Using Unpublished Interfaces or Functionality CAPEC-51: Poison Web Service Registry Poison Web Service Registry CAPEC-57: Utilizing REST's Trust in the System Resource to Obtain Sensitive Data Utilizing REST's Trust in the System Resource to Obtain Sensitive Data CAPEC-59: Session Credential Falsification through Prediction Session Credential Falsification through Prediction CAPEC-65: Sniff Application Code Sniff Application Code CAPEC-74: Manipulating State Manipulating State CAPEC-87: Forceful Browsing Forceful Browsing CAPEC-107: Cross Site Tracing Cross Site Tracing CAPEC-127: Directory Indexing Directory Indexing CAPEC-237: Escaping a Sandbox by Calling Code in Another Language Escaping a Sandbox by Calling Code in Another Language CAPEC-477: Signature Spoofing by Mixing Signed and Unsigned Content Signature Spoofing by Mixing Signed and Unsigned Content CAPEC-480: Escaping Virtualization Escaping Virtualization CAPEC-668: Key Negotiation of Bluetooth Attack (KNOB) Key Negotiation of Bluetooth Attack (KNOB)

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

aifinalwarning/microsoft_benevolent_offramps

Open architecture for building AI platforms where benevolence is structural, not a policy statement. Fuses layered offramps (code → infra → network → financial → governance), safe interruptibility research, IAPS taxonomy, consent-first design, and a healing layer — grounded in real CVEs from Microsoft's 2025–26 ecosystem. Apache 2.0.

ai-alignment ai-governance ai-safety benevolent-ai consent-management kill-switch llm-security multi-agent-systems offramp post-quantum-cryptography prompt-injection red-teaming regenerative-design responsible-ai zero-trust safe-interruptibility

HTML

Updated: 2 weeks, 1 day ago

1 stars 0 fork 0 watcher

Born at : March 8, 2026, 5:44 p.m. This repo has been linked 4 different CVEs too.

ayiz09/ayiz09.github.io

None

Updated: 2 weeks, 6 days ago

0 stars 0 fork 0 watcher

Born at : Feb. 26, 2026, 6:34 p.m. This repo has been linked 1 different CVEs too.

kapetanios55/SentinelCBContent

None

Shell Python

Updated: 3 weeks, 6 days ago

0 stars 0 fork 0 watcher

Born at : Feb. 20, 2026, 10:40 p.m. This repo has been linked 23 different CVEs too.

greenido/CISA-alerts-bot

A stateless GitHub Action that monitors Cybersecurity Alerts and sends structured alerts to Slack / Telegram

TypeScript

Updated: 1 month, 1 week ago

0 stars 0 fork 0 watcher

Born at : Feb. 13, 2026, 4:10 a.m. This repo has been linked 6 different CVEs too.

ekomsSavior/Cerberus

Cerberus-CVE Assessment Situation

Python

Updated: 1 month, 1 week ago

13 stars 5 fork 5 watcher

Born at : Nov. 3, 2025, 7:46 p.m. This repo has been linked 6 different CVEs too.

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2026-21513 vulnerability anywhere in the article.

The Hacker News

Interlock Ransomware Exploits Cisco FMC Zero-Day CVE-2026-20131 for Root Access

Amazon Threat Intelligence is warning of an active Interlock ransomware campaign that's exploiting a recently disclosed critical security flaw in Cisco Secure Firewall Management Center (FMC) Software ...