CVE-2026-21513KEV · OVERDUECWE-693

MSHTML Framework Security Feature Bypass Vulnerability

High · published February 10, 2026

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 8.8. It is confirmed in active exploitation. It sits in the 96.9th percentile for exploit probability.

236
days past CISA
deadline
CVSS v3.1
8.8
EPSS
16%
Percentile
96.9
In the wild
Confirmed
What it is

🚨 A security feature in the MSHTML Framework is letting attackers slip through the cracks! This protection mechanism failure is a golden ticket for unauthorized access over the network. ⚡ Think of it like a bouncer at a club who forgets to check IDs on one particular night, allowing anyone to stroll in without a second glance — it opens the door for trouble! With this vulnerability, an attacker could bypass critical security measures and gain unauthorized access, potentially leading to data theft or even system compromise. This isn't just a minor slip; it's a major breach that could leave sensitive information vulnerable to exploitation.

Put simply

Think of it like a bouncer at a club who forgets to check IDs on one particular night, allowing anyone to stroll in without a second glance — it opens the door for trouble! CVE-2026-21513 exposes a flaw in the MSHTML Framework's security mechanisms, allowing unauthorized users to bypass established protections over a network.

What to do

With this vulnerability, an attacker could bypass critical security measures and gain unauthorized access, potentially leading to data theft or even system compromise. This isn't just a minor slip; it's a major breach that could leave sensitive information vulnerable to exploitation. To mitigate this, update to the latest version of the MSHTML Framework immediately. Review and reinforce your network security protocols to ensure unauthorized access is blocked. Don't wait — protect your systems now! You've got this! Implement these changes and you'll be on your way to securing your environment. 🛡️

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
CVSS v4.0
Not supplied
EPSS
0.15852 · 96.9th percentile
Weakness
CWE-693 · Protection Mechanism Failure
Published
2026-02-10T17:51Z
KEV added
2026-02-10 · due 2026-03-03
EPSS history
Timeline
  • 10 FEB 17:51Z
    MSHTML Framework Security Feature Bypass Vulnerability
    cvelistv5
  • 10 FEB 00:00Z
    Added to CISA KEV — remediate by Mar 3
    kev