CVE-2026-21513

As of 2026-03-30, CVE-2026-21513 is a CVSS 8.8 (HIGH-severity) vulnerability. CISA KEV-listed (known exploited). EPSS exploitation probability 28.0%. Threadlinqs Intelligence tracks 6 threats exploiting it.

Last updated: 2026-03-30

Protection mechanism failure in MSHTML Framework allows an unauthorized attacker to bypass a security feature over a network.

CVSS v3 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-693

Exploitation status

CISA KEV-listed (known exploited)

Threats tracking this CVE

• Exposed Server Reveals AI-Assisted WebDAV Phishing Kit Targeting Mexican Users (CVE-2025-33053) — HIGH
• CVE-2026-32202 — Windows Shell Protection Mechanism Failure: NTLM Authentication Coercion via Auto-Parsed LNK Files (CISA KEV) — CRITICAL
• Pawn Storm (APT28) Deploys PRISMEX Malware Suite via CVE-2026-21509 and CVE-2026-21513 Zero-Days Targeting Ukrainian Defense Supply Chain — CRITICAL
• Microsoft MSHTML Remote Code Execution Zero-Day (CVE-2026-21513) — CRITICAL
• February 2026 Patch Tuesday: Six Zero-Days Among 59 CVEs — CrowdStrike-Discovered RDP EoP Exploited Since December 2025 — CRITICAL
• February 2026 Patch Tuesday: Six Zero-Days Among 59 CVEs — CRITICAL

References

• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21513
• https://www.vicarius.io/vsociety/posts/cve-2026-21513-detection-script-security-feature-bypass-vulnerability-in-mshtml-framework
• https://www.vicarius.io/vsociety/posts/cve-2026-21513-mitigation-script-security-feature-bypass-vulnerability-in-mshtml-framework
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-21513

← all vulnerabilities · Markdown version · Threadlinqs Intelligence

Enriched from CVE.org, NVD (this product uses the NVD API but is not endorsed or certified by the NVD), FIRST EPSS, CISA KEV, and GitHub Security Advisories.