Microsoft MSHTML security feature bypass
Protection mechanism failure in Microsoft MSHTML lets unauthenticated attackers bypass a security feature over the network. CVSS 8.8, patched in Microsoft's February 2026 Patch Tuesday.
- Vendor
- Microsoft
- Product
- MSHTML Framework (Windows)
- CVSS
- 8.8
- EPSS (exploit probability)
- 15.9%
- Status
- kev
- CISA patch-by (BOD 22-01)
- Published
Is CVE-2026-21513 being exploited?
Yes. CISA added CVE-2026-21513 to its Known Exploited Vulnerabilities catalog on . CISA only lists a CVE when it has reliable evidence of exploitation in the wild.
FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 15.9% (scored October 14, 2026).
- CISA KEV[ LISTED ]
- ENISA EUVD (exploited)[ — ]
- CIRCL KEV[ — ]
Catalog snapshot 2026-11-13. Full cross-catalog view: /kev-comparison
CVE-2026-21513 timeline
- Added to CISA KEVsame day as NVD
- Published to NVD
- First 0dayNews coverage+160d
Every event links to its source. Catalog dates are each catalog's own; day offsets count from NVD publication. Data: JSON
What to do
US federal civilian agencies must remediate by (21 days after listing) under BOD 22-01. Everyone else: that deadline is a sensible upper bound, not a target. Vendor guidance and the NVD record are linked under Source above.
A protection mechanism failure in Microsoft’s MSHTML Framework allows an unauthenticated remote attacker to bypass a security feature over a network. NVD rates it CVSS 8.8 (high). Microsoft patched it in the February 2026 Patch Tuesday cycle.
The vulnerability surfaced in operational context when Rapid7 analyzed an exposed attacker WebDAV lab in July 2026. Among the artifacts recovered: CVE-2026-21513 was one of three already-patched CVEs the operator was systematically QA’ing against targets in phishing campaigns targeting Mexico — alongside CVE-2025-33053 and CVE-2025-24054. The lab exposure confirmed active attacker interest in this flaw months after Microsoft shipped the fix.
Patch: apply the February 2026 Patch Tuesday cumulative update for your Windows version. NVD record.
Other Microsoft MSHTML CVEs we track
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV |
|---|---|---|---|---|
| CVE-2021-40444 MSHTML Remote Code Execution via Malicious Office Documentransomware usewrite-up | [ HIGH ] | 8.8 | 97.8% | |
| CVE-2019-0541 Microsoft MSHTML Remote Code Execution Vulnerability | [ HIGH ] | 8.8 | 53.2% |
