CVE-2026-21513
Microsoft MSHTML Framework Protection Mechanism Failure Vulnerability
Description
CVE-2026-21513 is a high-severity security feature bypass vulnerability in the MSHTML Framework component of Microsoft Windows, rated 8.8 on the CVSS v3.1 scale. The flaw enables an unauthorized attacker to bypass protection mechanisms over a network, requiring only that a user interacts with malicious content such as visiting a crafted webpage or opening a specially crafted file. The vulnerability affects a wide range of Windows versions including Windows 10 (multiple builds), Windows 11 (23H2, 24H2, 25H2), and Windows Server editions from 2016 through 2025. CISA has added this vulnerability to the Known Exploited Vulnerabilities catalog with a remediation deadline of March 3, 2026, confirming active exploitation. The EPSS score of 0.04119 (88.41st percentile) indicates a high probability of exploitation relative to most published vulnerabilities.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | windows 10 1607 | < 10.0.14393.8868 |
| microsoft | windows 10 1809 | < 10.0.17763.8389 |
| microsoft | windows 10 21h2 | < 10.0.19044.6937 |
| microsoft | windows 10 22h2 | < 10.0.19045.6937 |
| microsoft | windows 11 23h2 | < 10.0.22631.6649 |
| microsoft | windows 11 24h2 | < 10.0.26100.7781 |
| microsoft | windows 11 25h2 | < 10.0.26200.7781 |
| microsoft | windows server 2012 | -; r2 |
| microsoft | windows server 2016 | < 10.0.14393.8868 |
| microsoft | windows server 2019 | < 10.0.17763.8389 |
| microsoft | windows server 2022 | < 10.0.20348.4711 |
| microsoft | windows server 2022 23h2 | < 10.0.25398.2149 |
| microsoft | windows server 2025 | < 10.0.26100.32313 |
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21513(Vendor Advisory)
- https://www.vicarius.io/vsociety/posts/cve-2026-21513-detection-script-security-feature-bypass-vulnerability-in-mshtml-framework(Third Party Advisory)
- https://www.vicarius.io/vsociety/posts/cve-2026-21513-mitigation-script-security-feature-bypass-vulnerability-in-mshtml-framework(Mitigation, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-21513(US Government Resource)
Weakness Type
CWE-693: Protection Mechanism Failure
This vulnerability is classified under CWE-693: Protection Mechanism Failure, a weakness category describing products that fail to use, correctly implement, or maintain a protection mechanism. In CVE-2026-21513, the MSHTML Framework — the rendering engine historically used by Internet Explorer and still present in Windows for backward compatibility and embedded browser scenarios — fails to properly enforce a security feature designed to protect users from malicious content. MSHTML security bypasses are frequently chained with other vulnerabilities to achieve remote code execution, as the rendering engine processes HTML, scripts, and ActiveX controls that can be weaponized once protection mechanisms are defeated.
Impact Analysis
The impact of CVE-2026-21513 is rated high across all three security pillars. Confidentiality faces a high impact because bypassing MSHTML security features can expose sensitive data processed by the browser engine, including session tokens, cached credentials, and document contents. Integrity is highly impacted as a security bypass in MSHTML can allow an attacker to execute untrusted code or scripts that modify local files, inject content, or alter the behavior of applications relying on the MSHTML rendering engine. Availability is rated high because exploitation can lead to code execution scenarios that crash applications, corrupt data, or enable system-level compromise that disrupts normal operations. The attack vector is network-based (AV:N) with low complexity (AC:L) and requires no privileges (PR:N), though it does require user interaction (UI:R) — typically clicking a malicious link or opening a weaponized document. The breadth of affected Windows versions is extensive, spanning consumer and enterprise editions from Windows 10 1607 through Windows 11 25H2 and Windows Server 2016 through 2025. This means virtually all supported Windows environments are potentially vulnerable. The ransomware exploitation status is currently listed as unknown.
Exploit Maturity
CVE-2026-21513 has confirmed active exploitation, as evidenced by its inclusion in CISA's Known Exploited Vulnerabilities catalog with a mandatory remediation deadline of March 3, 2026. The EPSS score of 0.04119 (88.41st percentile) indicates a significantly elevated exploitation probability compared to most vulnerabilities. MSHTML vulnerabilities have historically been popular targets for both nation-state actors and cybercriminal groups, as the rendering engine is deeply embedded in Windows and often leveraged through Office documents, shortcut files, and other common attack vectors. While no public exploit code has been explicitly tagged in the available references, the KEV listing confirms that exploitation techniques are known and actively used in the wild.
Remediation
- Apply the latest Microsoft security update — Install the February 2026 cumulative update for your specific Windows version as detailed in the Microsoft Security Response Center advisory. Each affected Windows edition has a specific patch version that must be met or exceeded.
- Prioritize patching based on exposure — Systems with internet-facing users or those that regularly process external documents and emails should be patched first, as the vulnerability requires user interaction with malicious content delivered over the network.
- Enable attack surface reduction rules — Configure Microsoft Defender Attack Surface Reduction (ASR) rules to block Office applications from creating child processes and to prevent script execution in MSHTML contexts, which can reduce the exploitability of this class of vulnerability.
- Restrict MSHTML usage — Where operationally feasible, disable Internet Explorer mode in Microsoft Edge and limit applications that rely on the MSHTML rendering engine, reducing the attack surface.
- Educate users on phishing risks — Since exploitation requires user interaction, reinforce security awareness training focused on recognizing malicious links, suspicious email attachments, and untrusted document sources.
- Monitor for exploitation indicators — Review endpoint detection logs for unusual MSHTML process behavior, unexpected child process spawning from browser or Office applications, and network connections to known malicious infrastructure.
Technical Details
CVE-2026-21513 is a protection mechanism failure in the MSHTML Framework, the Trident-based HTML rendering engine that remains a core Windows component despite the transition to Chromium-based Edge. The CVSS v3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reveals that the attack is network-delivered with low complexity, requires no authentication, but does depend on a user action such as clicking a link or opening a crafted document. The scope is unchanged (S:U), meaning the impact remains within the security context of the vulnerable component rather than escalating to other system components. The affected version matrix is broad, covering Windows 10 builds 1607 (patch level below 10.0.14393.8868), 1809 (below 10.0.17763.8389), 21H2 and 22H2 (below 10.0.19044.6937 and 10.0.19045.6937 respectively), Windows 11 23H2 (below 10.0.22631.6649), 24H2 (below 10.0.26100.7781), 25H2 (below 10.0.26200.7781), and Windows Server 2016 through 2025 with corresponding build thresholds. MSHTML security feature bypasses have been a recurring attack pattern, often used to circumvent Mark of the Web (MotW) protections, SmartScreen warnings, or Protected View restrictions, enabling downstream exploitation through secondary vulnerabilities.
Frequently Asked Questions
What is the MSHTML Framework?
MSHTML (also known as Trident) is the HTML rendering engine originally built for Internet Explorer. Despite IE's retirement, MSHTML remains embedded in Windows and is used by various applications including Office documents with embedded web content, Internet Explorer mode in Edge, and third-party software that relies on the WebBrowser control.
How could an attacker exploit this vulnerability?
An attacker would need to convince a user to interact with malicious content — for example, by clicking a link to a crafted webpage, opening a specially crafted document, or viewing a malicious email in a rendering context that uses MSHTML.
Which Windows versions are affected?
Virtually all supported Windows versions are affected, including Windows 10 (builds 1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2), and Windows Server 2016, 2019, 2022, and 2025.
Is this vulnerability being actively exploited?
Yes. CISA has confirmed active exploitation by including CVE-2026-21513 in its Known Exploited Vulnerabilities catalog with a remediation deadline of March 3, 2026.
Can this vulnerability be exploited without user interaction?
No. The CVSS vector specifies UI:R, meaning the attacker needs the victim to perform an action such as clicking a link or opening a file.
What is the relationship between this vulnerability and Mark of the Web?
While the specific bypassed mechanism is not publicly detailed, MSHTML protection mechanism failures have historically been used to circumvent Mark of the Web tagging, SmartScreen prompts, or Protected View restrictions that normally warn users about potentially dangerous content.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.