Exploitation Summary
CVE-2021-26411 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added November 3, 2021, with confirmed use in ransomware campaigns. EIP tracks 1 public exploit from researchers including CrackerCat.
AI-analyzed exploit summary The repository contains only a README with a link to an external source (52pojie.cn) and no actual exploit code or technical details. This is characteristic of a social engineering lure.
Description
Internet Explorer Memory Corruption Vulnerability
Exploits (1)
nomisec
SUSPICIOUS
2 stars
by CrackerCat · poc
https://github.com/CrackerCat/CVE-2021-26411
The repository contains only a README with a link to an external source (52pojie.cn) and no actual exploit code or technical details. This is characteristic of a social engineering lure.
Classification
Suspicious 90%
Attack Type
Other
Complexity
Theoretical
Reliability
Theoretical
Target:
unknown
No auth needed
devstral-2 · analyzed Feb 18, 2026
Full analysis →
References (2)
Core 2
Core References
Patch, Vendor Advisory x_refsource_misc
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-26411
US Government Resource
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-26411
Scores
CVSS v3
8.8
EPSS
0.8110
EPSS Percentile
99.6%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:L
CISA SSVC
Vulnrichment
Exploitation
active
Automatable
no
Technical Impact
total
Details
CISA KEV
2021-11-03
VulnCheck KEV
2021-03-09
InTheWild.io
2021-03-09
ENISA EUVD
EUVD-2021-13217
Ransomware Use
Confirmed
CWE
CWE-416
Status
published
Products (3)
microsoft/edge
microsoft/internet_explorer
11
microsoft/internet_explorer
9
Published
Mar 11, 2021
KEV Added
Nov 03, 2021
Tracked Since
Feb 18, 2026