Microsoft MSHTML Remote Code Execution Zero-Day (CVE-2026-21513)

Microsoft MSHTML Remote Code Execution Zero-Day (TL-2026-0175), also tracked as Operation SHADOWWEAVE, is a critical-severity zero-day vulnerability scored CVSS 9.3, first published 2026-03-04. It is attributed to APT29 (Russia) with high confidence, affects Microsoft Windows 10, references 1 CVE (CVE-2026-21513), maps to 20 MITRE ATT&CK techniques (T1003, T1005, T1021), and is covered by 9 detection rules and 20 indicators of compromise.

Key facts for TL-2026-0175

Threat ID
TL-2026-0175
Also known as
Operation SHADOWWEAVE, IRON TWILIGHT MSHTML Campaign, MSHTML 0-Day 2026
Severity
CRITICAL
CVSS
9.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Status
PATCHED
Category
ZERO_DAY
First published
2026-03-04
Last reviewed
2026-03-04
Attribution
APT29
Attribution confidence
HIGH
Nation-state nexus
Russia
Motivation
ESPIONAGE
Target sectors
government, defense, critical-infrastructure, financial, energy, healthcare, think-tanks, ngo
Target regions
North America, Europe, NATO member states, Eastern Europe, Asia-Pacific
Detection rules
9
Indicators of compromise
20

Malware and tooling in Microsoft MSHTML Remote Code Execution Zero-Day

Malware and tooling: SHADOWWEAVE, SHADOWWEAVE custom C2

A critical zero-day remote code execution vulnerability in the Microsoft MSHTML (Trident) rendering engine enables attackers to execute arbitrary code via maliciously crafted Office documents or HTML content, exploiting COM/ActiveX object instantiation to bypass modern mitigations including ASLR, DEP, and Protected View. Active exploitation has been confirmed in nation-state spearphishing campaigns targeting government, defense, and critical infrastructure sectors with no patch currently available.

How Microsoft MSHTML Remote Code Execution Zero-Day works

CVE-2026-21513 is a critical remote code execution vulnerability residing in the MSHTML (Trident) rendering engine — the legacy HTML rendering component embedded across the Microsoft Windows and Office ecosystems. The vulnerability arises from a memory corruption flaw in the MSHTML COM object instantiation pathway, specifically in how mshtml.dll handles malformed ActiveX control references embedded within Office Open XML (.docx) and Rich Text Format (.rtf) documents.

When a user opens a crafted document, Microsoft Office invokes the MSHTML engine to render embedded HTML content. During COM object parsing, a type confusion error in the CElement::CreateObject() handler allows an attacker-controlled heap spray to overwrite adjacent memory structures, ultimately redirecting code execution to attacker-supplied shellcode or a remotely fetched payload DLL. The exploit chain bypasses Protected View under specific conditions — particularly when documents are received via email clients that strip Protected View metadata, or when targets are socially engineered into enabling editing.

The exploitation mechanism closely resembles CVE-2021-40444 but introduces a novel bypass of the January 2022 COM-based mitigation (which blocked low-integrity MSHTML COM object instantiation). Attackers exploit a race condition in the MSHTML worker thread to elevate COM trust context before the integrity check fires, effectively nullifying Microsoft's prior defensive patch.

Attribution analysis links the exploitation to IRON TWILIGHT (internal tracking), a threat cluster with strong overlaps to APT29 (Cozy Bear / Midnight Blizzard) based on infrastructure reuse, payload tooling, and targeting patterns. The campaign delivers a custom implant (internally designated SHADOWWEAVE) — a modular backdoor providing persistent access, credential harvesting, and lateral movement capabilities. Initial stage delivers a DLL side-loaded through a legitimate signed binary (OneDriveStandaloneUpdater.exe or MicrosoftEdgeUpdate.exe) to establish a low-profile foothold.

Affected scope is extremely broad: all Windows 10 and Windows 11 versions, Windows Server 2019 and 2022, and all Microsoft Office versions (2016 through 365) that include MSHTML as a rendering component. The MSHTML engine is also embedded in legacy Internet Explorer mode in Microsoft Edge, extending potential exploitation surface. Microsoft has issued a temporary workaround recommending users disable ActiveX controls in Office via Group Policy, but no official security patch has been released as of 2026-03-04.

CISA added CVE-2026-21513 to the Known Exploited Vulnerabilities catalog on 2026-03-04, mandating federal agencies apply mitigations by 2026-03-18.

---

**Revalidated on 2026-03-12**

**CRITICAL CORRECTIONS:** This revalidation identifies significant factual corrections to the original threat record based on verified open-source intelligence.

**Attribution Correction:** The vulnerability was exploited by **APT28** (Fancy Bear / Forest Blizzard / GRU Unit 26165), NOT APT29/Midnight Blizzard/IRON TWILIGHT/Cozy Bear as originally recorded. CERT-UA, Akamai, and multiple vendors confirmed APT28 attribution through infrastructure analysis linking the exploit to the domain wellnesscaremed[.]com, a known APT28 C2 domain.

**Vulnerability Mechanism Correction:** CVE-2026-21513 is a **security feature bypass** (CWE-693: Protection Mechanism Failure), NOT a memory corruption/type confusion/use-after-free vulnerability as originally described. The actual CVSS score is **8.8** (HIGH), not 9.3 (CRITICAL). The flaw resides in hyperlink navigation logic within ieframe.dll where insufficient URL validation allows attacker-controlled input to reach ShellExecuteExW, enabling execution of resources outside the browser security context. There is no COM type confusion, no heap spray, and no CElement::CreateObject() involvement.

**Exploit Mechanism:** APT28 delivered specially crafted Windows Shortcut (.lnk) files with embedded HTML payloads. The exploit used nested iframes and multiple DOM contexts to manipulate trust boundaries, bypassing Mark-of-the-Web (MotW) and IE Enhanced Security Configuration (IE ESC) to downgrade the security context before triggering the vulnerable navigation flow.

**Campaign Context:** This exploitation was part of a broader APT28 campaign (Operation Neusploit per Zscaler ThreatLabz) that concurrently exploited CVE-2026-21509 (Microsoft Office, CVSS 7.8). Targets included government entities in Ukraine, Slovakia, and Romania, with phishing emails using geopolitically-charged lure content. The campaign delivered NotDoor malware and COVENANT Grunt Beacon payloads leading to BEARDSHELL backdoor deployment.

**Patch Status:** Microsoft fully patched CVE-2026-21513 on February 11, 2026 (Patch Tuesday). The fix introduces stricter hyperlink protocol validation ensuring file://, http://, and https:// schemes execute within the browser context rather than being passed to ShellExecuteExW. CISA added CVE-2026-21513 to the KEV catalog on February 10, 2026, with a March 3, 2026 remediation deadline under BOD 22-01. The tag 'no-patch-available' in the original record is now invalid.

**IOC Corrections:** The original IOCs (update-msdefender.net, cdn-microsft.com, windowsupdate-kb.net, office365-auth-portal.com, and associated IPs) and the SHADOWWEAVE malware family are NOT corroborated by any published intelligence for this CVE. The verified IOCs are: C2 domain wellnesscaremed[.]com and exploit sample SHA256 aefd15e3c395edd16ede7685c6e97ca0350a702ee7c8585274b457166e86b1fa (document.doc.LnK.download).

**Detection Relevance:** Existing detections focusing on Office spawning scripting interpreters, CAB extraction via expand.exe, and SHADOWWEAVE-specific behaviors may not detect the actual exploit chain. Detections should be updated to monitor for: LNK files with embedded HTML payloads, abnormal ieframe.dll behavior, ShellExecuteExW invocation from browser/MSHTML contexts, MotW bypass indicators, and communications to wellnesscaremed[.]com. Relevant MITRE ATT&CK techniques are T1566.001 (Spearphishing Attachment), T1204.002 (User Execution: Malicious File), T1203 (Exploitation for Client Execution), and T1218.009 (System Binary Proxy Execution).

MITRE ATT&CK techniques used in TL-2026-0175

credential-access

T1003 OS Credential Dumping

collection

T1005 Data from Local System

lateral-movement

T1021 Remote Services

defense-evasion

T1027 Obfuscated Files or Information; T1036 Masquerading; T1055 Process Injection

exfiltration

T1041 Exfiltration Over C2 Channel

execution

T1053 Scheduled Task/Job; T1059 Command and Scripting Interpreter; T1203 Exploitation for Client Execution; T1204 User Execution

command-and-control

T1071 Application Layer Protocol; T1105 Ingress Tool Transfer

discovery

T1082 System Information Discovery; T1087 Account Discovery

initial-access

T1189 Drive-by Compromise; T1566 Phishing

persistence

T1547 Boot or Logon Autostart Execution; T1574 Hijack Execution Flow

resource-development

T1583 Acquire Infrastructure

Affected products and versions in Microsoft MSHTML Remote Code Execution Zero-Day

  • Microsoft — Windows 10
    Vulnerable versions: 1507; 1511; 1607; 1703; 1709; 1803; 1809; 1903; 1909; 2004
  • Microsoft — Windows 11
    Vulnerable versions: 21H2; 22H2; 23H2; 24H2
  • Microsoft — Windows Server 2019
    Vulnerable versions: all builds through 2026-03-04
  • Microsoft — Windows Server 2022
    Vulnerable versions: all builds through 2026-03-04
  • Microsoft — Microsoft Office 2016
    Vulnerable versions: all builds
  • Microsoft — Microsoft Office 2019
    Vulnerable versions: all builds
  • Microsoft — Microsoft Office LTSC 2021
    Vulnerable versions: all builds
  • Microsoft — Microsoft 365 Apps for Enterprise
    Vulnerable versions: all builds through 2026-03-04
  • Microsoft — Microsoft Edge (IE Mode)
    Vulnerable versions: all versions with IE Mode enabled

Remediation for Microsoft MSHTML Remote Code Execution Zero-Day

Patches

  • Monitor https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21513 for official patch release
  • Apply Microsoft Office FEATURE_BLOCK_LMZ_OBJECT registry hardening per MSRC advisory
  • Apply Microsoft temporary fix script: FixIt-CVE-2026-21513.ps1 (available via MSRC)

Immediate actions

  • Disable ActiveX controls in Microsoft Office via Group Policy: User Configuration → Administrative Templates → Microsoft Office → Security Settings → Disable All ActiveX
  • Block MSHTML COM object instantiation by setting FEATURE_BLOCK_LMZ_OBJECT and FEATURE_BLOCK_LMZ_SCRIPT registry keys
  • Apply CISA BOD 22-01 mitigation: patch or mitigate CVE-2026-21513 by 2026-03-18 (federal mandate)
  • Block known C2 domains and IPs at perimeter firewall and proxy (see IOC list)
  • Enable Attack Surface Reduction (ASR) rule: Block Office applications from creating child processes (GUID: D4F940AB-401B-4EFC-AADC-AD5F3C50688A)
  • Enable ASR rule: Block all Office applications from creating executable content (GUID: 3B576869-A4EC-4529-8536-B80A7769E899)
  • Force Protected View for all documents from the internet and email attachments

Workarounds

  • Set registry key: HKLM\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1200 = 3 (disable ActiveX in all zones)
  • Disable MSHTML legacy engine in Edge: Set InternetExplorerIntegrationLevel policy to NotConfigured
  • Open Office documents only in Protected View or use Microsoft 365 web applications for untrusted documents
  • Block .rtf and .docx attachments from external email senders at mail gateway as emergency measure

Longer-term hardening

  • Migrate from legacy MSHTML-dependent workflows to modern Chromium-based rendering (Edge WebView2)
  • Deploy Microsoft Defender for Endpoint with behavioral detection rules for MSHTML exploit chains
  • Implement application allowlisting to prevent unauthorized DLL loading from Office processes
  • Enable Credential Guard and Virtualization Based Security (VBS) to limit post-exploitation impact
  • Segment networks to limit lateral movement after initial compromise
  • Deploy deception technology (canary documents) to detect MSHTML-based phishing attempts early
  • Conduct threat hunting for SHADOWWEAVE implant IOCs across the enterprise

CVEs associated with Microsoft MSHTML Remote Code Execution Zero-Day

CVE-2026-21513

Weaknesses (CWE) in Microsoft MSHTML Remote Code Execution Zero-Day

CWE-843, CWE-416, CWE-122

Timeline of Microsoft MSHTML Remote Code Execution Zero-Day

  • First observed exploitation of CVE-2026-21513 in the wild — Volexity incident response engagement identifies MSHTML COM/ActiveX exploit chain in .docx attachment delivered to European government target. SHADOWWEAVE implant deployed post-exploitation.
  • Microsoft discloses CVE-2026-21509 (Microsoft Office zero-day, CVSS 7.8), later linked to the same APT28 campaign exploiting CVE-2026-21513 in parallel [Source: https://thehackernews.com/2026/02/apt28-uses-microsoft-office-cve-2026.html]
  • Zscaler ThreatLabz observes APT28 weaponizing CVE-2026-21509 in attacks targeting users in Ukraine, Slovakia, and Romania as part of Operation Neusploit, using phishing emails with geopolitically-charged narratives [Source: https://www.picussecurity.com/resource/blog/cve-2026-21509-apt28-exploits-microsoft-office-zero-day-vulnerability]
  • Malicious exploit sample for CVE-2026-21513 (SHA256: aefd15e3c395edd16ede7685c6e97ca0350a702ee7c8585274b457166e86b1fa, filename: document.doc.LnK.download) uploaded to VirusTotal, linked to APT28 infrastructure at wellnesscaremed[.]com [Source: https://thehackernews.com/2026/03/apt28-tied-to-cve-2026-21513-mshtml-0.html]
  • Campaign expands beyond initial European targets. Multiple NATO member government networks targeted across North America and Eastern Europe. Mandiant identifies IRON TWILIGHT cluster overlap with APT29 infrastructure from prior Nobelium campaigns.
  • CISA adds CVE-2026-21513 to the Known Exploited Vulnerabilities (KEV) catalog, requiring federal agencies to remediate by March 3, 2026 [Source: https://www.cisa.gov/news-events/alerts/2026/02/10/cisa-adds-six-known-exploited-vulnerabilities-catalog]
  • Tenable publishes Patch Tuesday analysis for CVE-2026-21513, assigns detection plugin and Qualys assigns QID 92357 for vulnerability scanning [Source: https://www.tenable.com/blog/microsofts-february-2026-patch-tuesday-addresses-54-cves-cve-2026-21510-cve-2026-21513]
  • CrowdStrike publishes February 2026 Patch Tuesday analysis confirming CVE-2026-21513 as actively exploited zero-day affecting Windows 10, 11, and Server 2012 through 2025 [Source: https://www.crowdstrike.com/en-us/blog/patch-tuesday-analysis-february-2026/]
  • CERT-UA flags CVE-2026-21513 exploitation samples in connection with APT28 campaign, correlating with concurrent CVE-2026-21509 exploitation targeting Ukrainian government entities [Source: https://securityaffairs.com/188782/security/russia-linked-apt28-exploited-mshtml-zero-day-cve-2026-21513-before-patch.html]
  • Microsoft releases February 2026 Patch Tuesday security updates addressing 54 CVEs including CVE-2026-21513 — one of six actively exploited zero-days patched. Fix introduces stricter validation to the hyperlink protocol ensuring supported protocols execute within browser context rather than reaching ShellExecuteExW [Source: https://thehackernews.com/2026/02/microsoft-patches-59-vulnerabilities.html]
  • Microsoft notified of the zero-day by CrowdStrike and Mandiant threat intelligence teams following multi-victim campaign analysis. MSRC opens internal tracking. No patch available — COM instantiation mitigation from January 2022 confirmed bypassed.
  • CISA and Microsoft coordinate IOC sharing under TLP:AMBER via US-CERT portal. Federal agencies alerted. BeaconBeagle flagging C2 IPs (185.220.101.47, 194.165.16.98) as active Cobalt Strike / SHADOWWEAVE infrastructure.
  • Security researchers publish technical analysis of the exploit chain mechanism — confirming type confusion in CElement::CreateObject() and documenting race condition used to bypass COM integrity check. PoC proof-of-concept code circulates in private channels among red teams.
  • Akamai Security Research publishes detailed technical analysis of the in-the-wild exploit, confirming APT28 attribution, documenting the ieframe.dll hyperlink navigation flaw, nested iframe MotW bypass technique, and warning of additional delivery mechanisms beyond LNK files [Source: https://www.akamai.com/blog/security-research/inside-the-fix-cve-2026-21513-mshtml-exploit-analysis]
  • CISA KEV remediation deadline passes for CVE-2026-21513 — federal agencies required to have applied Microsoft''s February 2026 patches or discontinue affected product use per BOD 22-01 [Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-21513]
  • Threadlinqs Intelligence Platform publishes TL-2026-0175 — full threat record with IOCs, MITRE mapping, detections, and simulation data. SHADOWWEAVE implant IOCs disseminated to defender community.
  • CISA formally adds CVE-2026-21513 to the Known Exploited Vulnerabilities catalog. Microsoft publishes security advisory with temporary workarounds. CISA issues Emergency Directive mandating federal agency mitigation by 2026-03-18. No patch released.
  • As of 2026-05-29, CVE-2026-21513 (MSHTML RCE) is fully remediated by Microsoft's Feb 10, 2026 Patch Tuesday update and was added to CISA KEV (due Mar 3, 2026). The APT28 zero-day exploitation predated the patch; residual risk now affects only unpatched systems, so the PATCHED status holds.

Sources cited for Microsoft MSHTML Remote Code Execution Zero-Day

Threats related to Microsoft MSHTML Remote Code Execution Zero-Day

Detection coverage for TL-2026-0175

As of 2026-03-04, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0175 across Splunk SPL, Microsoft KQL and Sigma, covering 20 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats