Skip to content

CVE · Exploited · On CISA KEV

CVE-2026-21513

Microsoft MSHTML Framework Protection Mechanism Failure Vulnerability

8.8
CVSS 3.1
2
stories
FEB 10
added to KEV
Severity
8.8 High · vendor score
Vendor
Microsoft
Product
Windows
Published
Feb 10, 2026
Added to KEV
Feb 10, 2026
KEV deadline
Mar 3, 2026
Ransomware use
Unknown
Weakness
CWE-693

What it is

Microsoft MSHTML Framework contains a protection mechanism failure vulnerability that could allow an unauthorized attacker to bypass a security feature over a network.

From CISA's Known Exploited Vulnerabilities catalog

Decipher coverage · 2 stories

Newest first ↑
  1. VulnerabilitiesMicrosoft Fixes Six Exploited Bugs in February Patch Tuesday UpdatesThe exploited vulnerabilities in question exist across various products, from Microsoft Word to Windows Shell.DECIPHER · 3 MIN
  2. VulnerabilitiesWindows CVE-2026-32202 Exploited in the WildThe current exploits are targeting CVE-2026-32202, a bug in the Windows Shell that allows an attacker to gain access to some sensitive data on the target network.DENNIS FISHER · 2 MIN

Official references

6 sources

Registries

RegistryNVDScore, weakness and every referenceRegistryCVE.orgThe official CVE recordRegistryCISA KEVKnown exploited, with the federal deadline

Advisories, fixes & analysis

Vendor advisorymsrc.microsoft.com/update-guide/vulnerability/CVE-2026-21513Fixvicarius.io/vsociety/posts/cve-2026-21513-mitigation-script-security-feature-bypass-vulnerability-in-mshtml-frameworkAnalysisvicarius.io/vsociety/posts/cve-2026-21513-detection-script-security-feature-bypass-vulnerability-in-mshtml-framework