CVE-2026-21513
HIGH KEVWindows MSHTML Security Feature Bypass (10, 11, 23H2, 24H2)
Title source: llmExploitation Summary
CVE-2026-21513 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added February 10, 2026.
Description
Protection mechanism failure in MSHTML Framework allows an unauthorized attacker to bypass a security feature over a network.
References (4)
Core 4
Core References
Various Sources
https://www.vicarius.io/vsociety/posts/cve-2026-21513-detection-script-security-feature-bypass-vulnerability-in-mshtml-framework
Various Sources
https://www.vicarius.io/vsociety/posts/cve-2026-21513-mitigation-script-security-feature-bypass-vulnerability-in-mshtml-framework
US Government Resource
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-21513
Vendor Advisory vendor-advisory
patch
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21513
Scores
CVSS v3
8.8
EPSS
0.2776
EPSS Percentile
96.6%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CISA SSVC
Vulnrichment
Exploitation
active
Automatable
no
Technical Impact
total
Details
CISA KEV
2026-02-10
VulnCheck KEV
2026-02-10
ENISA EUVD
EUVD-2026-7342
CWE
CWE-693
Status
published
Products (36)
Microsoft/Windows 10 Version 1607
10.0.14393.0 - 10.0.14393.8868
Microsoft/Windows 10 Version 1809
10.0.17763.0 - 10.0.17763.8389
Microsoft/Windows 10 Version 21H2
10.0.19044.0 - 10.0.19044.6937
Microsoft/Windows 10 Version 22H2
10.0.19045.0 - 10.0.19045.6937
Microsoft/Windows 11 version 22H3
10.0.22631.0 - 10.0.22631.6649
Microsoft/Windows 11 Version 23H2
10.0.22631.0 - 10.0.22631.6649
Microsoft/Windows 11 Version 24H2
10.0.26100.0 - 10.0.26100.7840
Microsoft/Windows 11 Version 25H2
10.0.26200.0 - 10.0.26200.7840
Microsoft/Windows 11 version 26H1
10.0.28000.0 - 10.0.28000.1575
Microsoft/Windows 11 Version 26H1
10.0.28000.0 - 10.0.28000.1575
... and 26 more
Published
Feb 10, 2026
KEV Added
Feb 10, 2026
Tracked Since
Feb 18, 2026