What is the CVSS score of CVE-2026-21513?

CVE-2026-21513 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 4.8%.

Which versions of MSHTML Framework are affected by CVE-2026-21513?

CVE-2026-21513 is a critical vulnerability in MSHTML Framework that is currently being actively exploited in the wild.. A patch is available.

Is CVE-2026-21513 being actively exploited?

Yes, CVE-2026-21513 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, confirming active in-the-wild exploitation. Immediate patching is required.

How to fix or mitigate CVE-2026-21513?

Within 24 hours: Identify and inventory all systems running MSHTML Framework; activate threat monitoring for exploitation attempts and isolate any confirmed compromised systems. Within 7 days: Implement all available compensating controls listed below; conduct vulnerability scanning to identify affected assets; brief leadership on risk posture and remediation timeline. Within 30 days: Continuously monitor for patch release from Microsoft; conduct incident response drills; prepare emergency patching procedures for rapid deployment once patch becomes available.

MSHTML Framework CVE-2026-21513

HIGH

Protection Mechanism Failure (CWE-693)

2026-02-10 secure@microsoft.com

Authentication Bypass

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Added to CISA KEV

Mar 30, 2026 - 13:28 cisa

CISA KEV

Analysis Generated

Mar 12, 2026 - 22:02 vuln.today

CVE Published

Feb 10, 2026 - 18:16 nvd

HIGH 8.8

DescriptionCVE.org

Protection mechanism failure in MSHTML Framework allows an unauthorized attacker to bypass a security feature over a network.

AnalysisAI

MSHTML Framework contains a protection mechanism failure (CVE-2026-21513, CVSS 8.8) allowing remote attackers to bypass security features over a network. KEV-listed, this vulnerability in the legacy HTML rendering engine (still used by many Windows applications and email clients) enables execution of malicious content by circumventing the browser's security sandbox and content restrictions.

Technical ContextAI

MSHTML (Trident) is the legacy HTML rendering engine used by Internet Explorer and many Windows applications that render HTML content (Outlook email preview, help files, many third-party apps). Despite IE's deprecation, MSHTML remains a critical attack surface because it's still used for rendering HTML in non-browser contexts. This bypass allows malicious content to execute outside the normal security restrictions applied to rendered HTML.

RemediationAI

Apply Microsoft security update immediately. Consider disabling HTML email rendering in Outlook (plain text mode). Enable ASR rules for MSHTML-based attacks. Monitor for exploitation indicators in email processing logs.