Vulnerability intelligence
CVE-2026-21510
Microsoft Windows Shell Protection Mechanism Failure Vulnerability
Protection mechanism failure in Windows Shell allows an unauthorized attacker to bypass a security feature over a network.
CVSS Score
8.8
High
EPSS — Exploit Probability
25%
Riskier than 98% of all CVEs · checked 2026-10-17
Exploitation
Confirmed in the wild
KEV since 2026-02-10
Remediation
Patch available
Federal deadline 2026-03-03
CISA required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Deadline for federal agencies: 2026-03-03.
11 articles across 8 outlets · first covered Apr 27, 2026 · latest Apr 29, 2026
Associated threat actors
Coverage timeline
-
CISA Flags Actively Exploited CVE-2024-1708 and Windows Flawthehackernews.com · Apr 29, 2026
-
Microsoft Warns of Active Exploit in CVE-2026-32202 Spoof Flawthehackernews.com · Apr 28, 2026
-
APT28 exploits Windows SmartScreen gap for zero click LNK attackswww.securityweek.com · Apr 27, 2026
-
February 2026 Patch Tuesday: Six Active Zero-Days & 53 Other Flaws Addressedsocradar.io · Feb 11, 2026
-
February 2026 Patch Tuesday includes six actively exploited zero-dayswww.malwarebytes.com · Feb 11, 2026
-
U.S. CISA adds Microsoft Office and Microsoft Windows flaws to its Known Exploited Vulnerabilities catalogsecurityaffairs.com · Feb 11, 2026
-
Patch Panic: Microsoft Fixes 6 Active Zero-Days in Feb 2026 Updatesecurityonline.info · Feb 11, 2026
-
Microsoft Patch Tuesday security updates for February 2026 fix six actively exploited zero-dayssecurityaffairs.com · Feb 10, 2026
-
Patch Tuesday, February 2026 Editionkrebsonsecurity.com · Feb 10, 2026
-
Microsoft Patches 6 Actively Exploited Zero-Dayswww.darkreading.com · Feb 10, 2026
-
6 Actively Exploited Zero-Days Patched by Microsoft With February 2026 Updateswww.securityweek.com · Feb 10, 2026