Vulnerability intelligence

CVE-2026-21513

Microsoft MSHTML Framework Protection Mechanism Failure Vulnerability

Protection mechanism failure in MSHTML Framework allows an unauthorized attacker to bypass a security feature over a network.

CVSS Score

8.8

High

EPSS — Exploit Probability

15%

Riskier than 96% of all CVEs

Exploitation

Confirmed in the wild

Used in ransomware campaigns

Remediation

Patch available

Federal deadline 2026-03-03

CISA required action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Deadline for federal agencies: 2026-03-03.

NVD entry Vendor patch PoC / advisory CISA KEV

5 articles across 4 outlets · first covered Apr 8, 2026 · latest May 7, 2026

Tracked incidents

vulnerability closed 4 articles

CISA adds Windows Shell and ConnectWise ScreenConnect flaws to Known Exploited Vulnerabilities catalog

Associated threat actors

APT28

Coverage timeline

Office and Windows flaws boost exploit kits in Q1 2026
securelist.com · May 7, 2026
Microsoft Warns of Active Exploit in CVE-2026-32202 Spoof Flaw
thehackernews.com · Apr 28, 2026
APT28 exploits Windows SmartScreen gap for zero click LNK attacks
www.securityweek.com · Apr 27, 2026
Russia-linked APT28 uses PRISMEX to infiltrate Ukraine and allied infrastructure with advanced tactics
securityaffairs.com · Apr 8, 2026
APT28 Deploys New PRISMEX Malware Against Ukraine and NATO Allies
thehackernews.com · Apr 8, 2026

Related CVEs — Microsoft

CVE-2026-45659KEV CVE-2026-33825KEV CVE-2026-42897KEV CVE-2026-41091KEV CVE-2008-4250KEV CVE-2009-1537KEV CVE-2010-0249KEV CVE-2010-0806KEV