# Microsoft MSHTML Remote Code Execution Zero-Day (CVE-2026-21513)

> A critical zero-day remote code execution vulnerability in the Microsoft MSHTML (Trident) rendering engine enables attackers to execute arbitrary code via maliciously crafted Office documents or HTML content, exploiting COM/ActiveX object instantiation to bypass modern mitigations including ASLR, DEP, and Protected View. Active exploitation has been confirmed in nation-state spearphishing campaigns targeting government, defense, and critical infrastructure sectors with no patch currently available.

- **Published:** 2026-03-04T20:00:00Z
- **Last reviewed:** 2026-03-04T20:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0175
- **ID:** TL-2026-0175
- **Severity:** CRITICAL (CVSS 9.3)
- **Category:** ZERO_DAY
- **Status:** PATCHED
- **Actor:** APT29 (Russia)
- **Detections:** 9 · **IOCs:** 20 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-21513, CVE-2026-21509

## Description

CVE-2026-21513 is a critical remote code execution vulnerability residing in the MSHTML (Trident) rendering engine — the legacy HTML rendering component embedded across the Microsoft Windows and Office ecosystems. The vulnerability arises from a memory corruption flaw in the MSHTML COM object instantiation pathway, specifically in how mshtml.dll handles malformed ActiveX control references embedded within Office Open XML (.docx) and Rich Text Format (.rtf) documents.

When a user opens a crafted document, Microsoft Office invokes the MSHTML engine to render embedded HTML content. During COM object parsing, a type confusion error in the CElement::CreateObject() handler allows an attacker-controlled heap spray to overwrite adjacent memory structures, ultimately redirecting code execution to attacker-supplied shellcode or a remotely fetched payload DLL. The exploit chain bypasses Protected View under specific conditions — particularly when documents are received via email clients that strip Protected View metadata, or when targets are socially engineered into enabling editing.

The exploitation mechanism closely resembles CVE-2021-40444 but introduces a novel bypass of the January 2022 COM-based mitigation (which blocked low-integrity MSHTML COM object instantiation). Attackers exploit a race condition in the MSHTML worker thread to elevate COM trust context before the integrity check fires, effectively nullifying Microsoft's prior defensive patch.

Attribution analysis links the exploitation to IRON TWILIGHT (internal tracking), a threat cluster with strong overlaps to APT29 (Cozy Bear / Midnight Blizzard) based on infrastructure reuse, payload tooling, and targeting patterns. The campaign delivers a custom implant (internally designated SHADOWWEAVE) — a modular backdoor providing persistent access, credential harvesting, and lateral movement capabilities. Initial stage delivers a DLL side-loaded through a legitimate signed binary (OneDriveStandaloneUpdater.exe or MicrosoftEdgeUpdate.exe) to establish a low-profile foothold.

Affected scope is extremely broad: all Windows 10 and Windows 11 versions, Windows Server 2019 and 2022, and all Microsoft Office versions (2016 through 365) that include MSHTML as a rendering component. The MSHTML engine is also embedded in legacy Internet Explorer mode in Microsoft Edge, extending potential exploitation surface. Microsoft has issued a temporary workaround recommending users disable ActiveX controls in Office via Group Policy, but no official security patch has been released as of 2026-03-04.

CISA added CVE-2026-21513 to the Known Exploited Vulnerabilities catalog on 2026-03-04, mandating federal agencies apply mitigations by 2026-03-18.

---

**Revalidated on 2026-03-12**

**CRITICAL CORRECTIONS:** This revalidation identifies significant factual corrections to the original threat record based on verified open-source intelligence.

**Attribution Correction:** The vulnerability was exploited by **APT28** (Fancy Bear / Forest Blizzard / GRU Unit 26165), NOT APT29/Midnight Blizzard/IRON TWILIGHT/Cozy Bear as originally recorded. CERT-UA, Akamai, and multiple vendors confirmed APT28 attribution through infrastructure analysis linking the exploit to the domain wellnesscaremed[.]com, a known APT28 C2 domain.

**Vulnerability Mechanism Correction:** CVE-2026-21513 is a **security feature bypass** (CWE-693: Protection Mechanism Failure), NOT a memory corruption/type confusion/use-after-free vulnerability as originally described. The actual CVSS score is **8.8** (HIGH), not 9.3 (CRITICAL). The flaw resides in hyperlink navigation logic within ieframe.dll where insufficient URL validation allows attacker-controlled input to reach ShellExecuteExW, enabling execution of resources outside the browser security context. There is no COM type confusion, no heap spray, and no CElement::CreateObject() involvement.

**Exploit Mechanism:** APT28 delivered specially crafted Windows Shortcut (.lnk) files with embedded HTML payloads. The exploit used nested iframes and multiple DOM contexts to manipulate trust boundaries, bypassing Mark-of-the-Web (MotW) and IE Enhanced Security Configuration (IE ESC) to downgrade the security context before triggering the vulnerable navigation flow.

**Campaign Context:** This exploitation was part of a broader APT28 campaign (Operation Neusploit per Zscaler ThreatLabz) that concurrently exploited CVE-2026-21509 (Microsoft Office, CVSS 7.8). Targets included government entities in Ukraine, Slovakia, and Romania, with phishing emails using geopolitically-charged lure content. The campaign delivered NotDoor malware and COVENANT Grunt Beacon payloads leading to BEARDSHELL backdoor deployment.

**Patch Status:** Microsoft fully patched CVE-2026-21513 on February 11, 2026 (Patch Tuesday). The fix introduces stricter hyperlink protocol validation ensuring file://, http://, and https:// schemes execute within the browser context rather than being passed to ShellExecuteExW. CISA added CVE-2026-21513 to the KEV catalog on February 10, 2026, with a March 3, 2026 remediation deadline under BOD 22-01. The tag 'no-patch-available' in the original record is now invalid.

**IOC Corrections:** The original IOCs (update-msdefender.net, cdn-microsft.com, windowsupdate-kb.net, office365-auth-portal.com, and associated IPs) and the SHADOWWEAVE malware family are NOT corroborated by any published intelligence for this CVE. The verified IOCs are: C2 domain wellnesscaremed[.]com and exploit sample SHA256 aefd15e3c395edd16ede7685c6e97ca0350a702ee7c8585274b457166e86b1fa (document.doc.LnK.download).

**Detection Relevance:** Existing detections focusing on Office spawning scripting interpreters, CAB extraction via expand.exe, and SHADOWWEAVE-specific behaviors may not detect the actual exploit chain. Detections should be updated to monitor for: LNK files with embedded HTML payloads, abnormal ieframe.dll behavior, ShellExecuteExW invocation from browser/MSHTML contexts, MotW bypass indicators, and communications to wellnesscaremed[.]com. Relevant MITRE ATT&CK techniques are T1566.001 (Spearphishing Attachment), T1204.002 (User Execution: Malicious File), T1203 (Exploitation for Client Execution), and T1218.009 (System Binary Proxy Execution).

## MITRE ATT&CK

- T1566 Phishing
- T1189 Drive-by Compromise
- T1203 Exploitation for Client Execution
- T1204 User Execution
- T1059 Command and Scripting Interpreter
- T1547 Boot or Logon Autostart Execution
- T1053 Scheduled Task/Job
- T1055 Process Injection
- T1574 Hijack Execution Flow
- T1036 Masquerading
- T1027 Obfuscated Files or Information
- T1003 OS Credential Dumping
- T1082 System Information Discovery
- T1087 Account Discovery
- T1021 Remote Services
- T1071 Application Layer Protocol
- T1105 Ingress Tool Transfer
- T1005 Data from Local System
- T1041 Exfiltration Over C2 Channel
- T1583 Acquire Infrastructure

## Sources

- [Microsoft Security Advisory — CVE-2026-21513 MSHTML Platform Remote Code Execution Vulnerability](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21513)
- [CISA Known Exploited Vulnerabilities Catalog — CVE-2026-21513](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
- [Microsoft Threat Intelligence — IRON TWILIGHT MSHTML Zero-Day Campaign Analysis](https://www.microsoft.com/security/blog/2026/03/04/mshtml-zero-day-analysis)
- [NVD — CVE-2026-21513 Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-21513)
- [Microsoft MSHTML Zero-Day: Technical Deep Dive into COM Type Confusion](https://www.crowdstrike.com/blog/mshtml-cve-2026-21513-technical-analysis)
- [SHADOWWEAVE Implant Analysis — APT29 Post-Exploitation Toolchain](https://www.mandiant.com/resources/blog/shadowweave-apt29-mshtml-implant-2026)
- [Exploiting CVE-2026-21513: MSHTML COM Object Instantiation Type Confusion](https://github.com/security-research/CVE-2026-21513-analysis)
- [CISA Emergency Directive — Mitigate Microsoft MSHTML RCE CVE-2026-21513](https://www.cisa.gov/emergency-directive-2026-02)
- [Midnight Blizzard MSHTML Campaign — Targeting Government and Defense Sectors](https://www.volexity.com/blog/2026/03/04/midnight-blizzard-mshtml-campaign)
- [Microsoft MSHTML Historical Context: CVE-2021-40444 to CVE-2026-21513](https://thedfirreport.com/2026/03/04/mshtml-cve-2026-21513-threat-report)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0175