CVE-2026-21513: Microsoft MSHTML security feature bypass on Windows

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

high priorityIt is in CISA KEV with confirmed in-the-wild exploitation and a CVSS of 8.8 across a wide Windows install base, though it requires user interaction.

What it is

CVE-2026-21513 is a protection mechanism failure (CWE-693) in the Microsoft MSHTML Framework that lets an unauthorized attacker bypass a security feature over a network. It affects a broad set of Windows 10, Windows 11 and Windows Server releases, so unpatched endpoints and servers running the MSHTML engine are exposed. The record does not describe the specific security feature bypassed or the exact exploitation mechanism.

Impact

An attacker can bypass a security control and, per the CVSS vector, achieve high confidentiality, integrity and availability impact on the target. The record does not state what code execution or data access follows the bypass.

Attack surface

Reachable over the network with no privileges required, but the CVSS vector requires user interaction (UI:R), so a victim must take an action such as opening crafted content. No affected component list beyond the MSHTML Framework is given.

Exploitation

CVE-2026-21513 is listed in CISA KEV with a due date of 2026-03-03, indicating known exploitation in the wild. EPSS is 0.15642 (96.7th percentile), and no ransomware campaign use is documented.

What to do

• Apply the Microsoft MSHTML Framework security update from the MSRC advisory as the first action.
• Follow CISA BOD 22-01 guidance and meet the 2026-03-03 KEV remediation due date.
• If patching is not immediately possible, apply the vendor-recommended mitigations or discontinue use of the affected product.
• Reduce exposure of MSHTML rendering to untrusted web content and email until systems are patched.

Detection

• Hunt for MSHTML-related process activity, such as mshtml.dll loading in unexpected host processes, on affected Windows builds.
• Monitor for suspicious child processes or script execution originating from browsers, Office or other applications that render untrusted content.
• Review network and endpoint telemetry for delivery of crafted content to unpatched Windows 10, Windows 11 and Windows Server hosts.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.