Microsoft MSHTML Remote Code Execution Zero-Day (CVE-2026-21513) — Threadlinqs Intelligence
As of 2026-05-30, Microsoft MSHTML Remote Code Execution Zero-Day (CVE-2026-21513) is a critical-severity zero day threat attributed to APT29 (Russia), tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 20 indicators of compromise.
Threat ID: TL-2026-0175 · Severity: CRITICAL · CVSS: 9.3 · Status: PATCHED · Category: ZERO_DAY
Attribution: APT29 · Russia · ESPIONAGE
A critical zero-day remote code execution vulnerability in the Microsoft MSHTML (Trident) rendering engine enables attackers to execute arbitrary code via maliciously crafted Office documents or HTML
CVE-2026-21513 is a critical remote code execution vulnerability residing in the MSHTML (Trident) rendering engine — the legacy HTML rendering component embedded across the Microsoft Windows and Office ecosystems. The vulnerability arises from a memory corruption flaw in the MSHTML COM object instantiation pathway, specifically in how mshtml.dll handles malformed ActiveX control references embedded within Office Open XML (.docx) and Rich Text Format (.rtf) documents.
When a user opens a crafted document, Microsoft Office invokes the MSHTML engine to render embedded HTML content. During COM object parsing, a type confusion error in the CElement::CreateObject() handler allows an attacker-controlled heap spray to overwrite adjacent memory structures, ultimately redirecting code execution to attacker-supplied shellcode or a remotely fetched payload DLL. The exploit chain bypasses Protected View under specific conditions — particularly when documents are received via email clients that strip Protected View metadata, or when targets are socially engineered into enabling editing.
The exploitation mechanism closely resembles CVE-2021-40444 but introduces a novel bypass of the January 2022 COM-based mitigation (which blocked low-integrity MSHTML COM object instantiation). Attackers exploit a race condition in the MSHTML worker thread to elevate COM trust context before the integrity check fires, effectively nullifying Microsoft's prior defensive patch.
Attribution analysis links the exploitation to IRON TWILIGHT (internal tracking), a threat cluster with strong overlaps to APT29 (Cozy Bear / Midnight Blizzard) based on infrastructure reuse, payload tooling, and targeting patterns. The campaign delivers a custom implant (internally designated SHADOWWEAVE) — a modular backdoor providing persistent access, credential harvesting, and lateral movement capabilities. Initial stage delivers a DLL side-loaded through a legitimate signed binary (OneDriveStandaloneUpdater.exe or MicrosoftEdgeUpdate.exe) to establish a low-profile foothold.
Affected scope is extremely broad: all Windows 10 and Windows 11 versions, Windows Server 2019 and 2022, and all Microsoft Office versions (2016 through 365) that include MSHTML as a rendering component. The MSHTML engine is also embedded in legacy Internet Explorer mode in Microsoft Edge, extending potential exploitation surface. Microsoft has issued a temporary workaround recommending users disable ActiveX controls in Office via Group Policy, but no official security patch has been released as of 2026-03-04.
CISA added CVE-2026-21513 to the Known Exploited Vulnerabilities catalog on 2026-03-04, mandating federal agencies apply mitigations by 2026-03-18.
---
**Revalidated on 2026-03-12**
**CRITICAL CORRECTIONS:** This revalidation identifies significant factual corrections to the original threat record based on verified open-source intelligence.
**Attribution Correction:** The vulnerability was exploited by **APT28** (Fancy Bear / Forest Blizzard / GRU Unit 26165), NOT APT29/Midnight Blizzard/IRON TWILIGHT/Cozy Bear as originally recorded. CERT-UA, Akamai, and multiple vendors confirmed APT28 attribution through infrastructure analysis linking the exploit to the domain wellnesscaremed[.]com, a known APT28 C2 domain.
**Vulnerability Mechanism Correction:** CVE-2026-21513 is a **security feature bypass** (CWE-693: Protection Mechanism Failure), NOT a memory corruption/type confusion/use-after-free vulnerability as originally described. The actual CVSS score is **8.8** (HIGH), not 9.3 (CRITICAL). The flaw resides in hyperlink navigation logic within ieframe.dll where insufficient URL validation allows attacker-controlled input to reach ShellExecuteExW, enabling execution of resources outside the browser security context. There is no COM type confusion, no heap spray, and no CElement::CreateObject() involvement.
**Exploit Mechanism:** APT28 delivered specially crafted Windows Shortcut (.lnk) files with
Weaknesses (CWE)
CWE-843, CWE-416, CWE-122
Target sectors: government, defense, critical-infrastructure, financial, energy, healthcare, think-tanks, ngo
Target regions: North America, Europe, NATO member states, Eastern Europe, Asia-Pacific
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 20 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
ZERO_DAY, CRITICAL, threat intelligence, cybersecurity, CVE-2026-21513, T1566, T1189, T1203, T1204, T1059, T1547, T1053, T1055, T1574, T1036