cbcvebase.
CVE-2026-21513
published 2026-02-10

CVE-2026-21513: Protection mechanism failure in MSHTML Framework allows an unauthorized attacker to bypass a security feature over a network.

PriorityP187high8.8CVSS 3.1
AVNACLPRNUIRSUCHIHAH
KEVITW
CISA Known Exploited Vulnerabilitydue 2026-03-03
Exploited in the wild
EPSS
15.38%
96.4th percentile
Protection mechanism failure in MSHTML Framework allows an unauthorized attacker to bypass a security feature over a network.

Affected

42 ranges· showing 25
VendorProductVersion rangeFixed in
microsoftwindows_10_1607< 10.0.14393.886810.0.14393.8868
microsoftwindows_10_1809< 10.0.17763.838910.0.17763.8389
microsoftwindows_10_21h2< 10.0.19044.693710.0.19044.6937
microsoftwindows_10_22h2< 10.0.19045.693710.0.19045.6937
microsoftwindows_10_version_1607>= 10.0.14393.0 < 10.0.14393.886810.0.14393.8868
microsoftwindows_10_version_1809>= 10.0.17763.0 < 10.0.17763.838910.0.17763.8389
microsoftwindows_10_version_21h2>= 10.0.19044.0 < 10.0.19044.693710.0.19044.6937
microsoftwindows_10_version_22h2>= 10.0.19045.0 < 10.0.19045.693710.0.19045.6937
microsoftwindows_11_23h2< 10.0.22631.664910.0.22631.6649
microsoftwindows_11_24h2< 10.0.26100.778110.0.26100.7781
microsoftwindows_11_25h2< 10.0.26200.778110.0.26200.7781
microsoftwindows_11_version_22h3>= 10.0.22631.0 < 10.0.22631.664910.0.22631.6649
microsoftwindows_11_version_23h2>= 10.0.22631.0 < 10.0.22631.664910.0.22631.6649
microsoftwindows_11_version_24h2>= 10.0.26100.0 < 10.0.26100.784010.0.26100.7840
microsoftwindows_11_version_25h2>= 10.0.26200.0 < 10.0.26200.784010.0.26200.7840
microsoftwindows_11_version_26h1>= 10.0.28000.0 < 10.0.28000.157510.0.28000.1575
microsoftwindows_server_2012
microsoftwindows_server_2012>= 6.2.9200.0 < 6.2.9200.259236.2.9200.25923
microsoftwindows_server_2012_r2>= 6.3.9600.0 < 6.3.9600.230226.3.9600.23022
microsoftwindows_server_2016< 10.0.14393.886810.0.14393.8868
microsoftwindows_server_2016>= 10.0.14393.0 < 10.0.14393.886810.0.14393.8868
microsoftwindows_server_2019< 10.0.17763.838910.0.17763.8389
microsoftwindows_server_2019>= 10.0.17763.0 < 10.0.17763.838910.0.17763.8389
microsoftwindows_server_2022< 10.0.20348.471110.0.20348.4711
microsoftwindows_server_2022>= 10.0.20348.0 < 10.0.20348.477310.0.20348.4773

Detection & IOCsextracted from sources · hover to see the quote

  • Hunt for LNK files that contain embedded HTML content (iframes, ActiveX htmlfile objects) immediately following the standard LNK binary structure — a strong indicator of CVE-2026-21513 exploitation.
  • Monitor for outbound SMB/WebDAV connections initiated by Office applications (e.g., triggered by RTF documents with embedded OLE objects referencing CLSID EAB22AC3-30C1-11CF-A7EB-0000C05BAE0B) as part of the CVE-2026-21509 → CVE-2026-21513 two-stage chain.
  • The exploit triggers ShellExecuteExW via the vulnerable MSHTML hyperlink navigation code path; monitor for ShellExecuteExW calls originating from ieframe.dll / MSHTML-hosted processes with remote or UNC-path targets.
  • Spear-phishing lures for this campaign use subject lines related to 'Hydro-meteorological Warnings,' 'Invitation to Military Training Program,' or 'Weapon Smuggling Alerts' — use these as email gateway detection strings.
  • PrismexStager abuses Filen.io cloud storage for C2; monitor for unexpected outbound connections to filen.io from endpoints, especially from processes associated with .NET implants.
  • The APT28 campaign uses COM DLL hijacking for persistence; hunt for unexpected DLL loads in COM server registry paths and scheduled tasks created by PrismexDrop.
  • ·The linkage between CVE-2026-21509 and CVE-2026-21513 as a confirmed two-stage chain has NOT been independently verified by Trend Micro Research — it is inferred from shared C&C infrastructure (wellnesscaremed[.]com) identified by Akamai.
  • ·While the primary observed delivery is malicious LNK files, the CVE-2026-21513 vulnerable code path can be triggered by any component embedding MSHTML, so detection should not be limited to LNK-based phishing.

CVSS provenance

nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
vulncheck8.8HIGH
cisa8.8HIGH
vendor_msrc8.8HIGH
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.