LiveThreat Vulnerability Brief — CVE‑2026‑21513 MSHTML Feature Bypass
What It Is — A critical MSHTML framework feature‑bypass (CVE‑2026‑21513) with a CVSS 8.8 score that allows unauthenticated code execution via crafted HTML. Akamai’s telemetry shows the Russia‑linked APT28 group leveraged the flaw in the wild before Microsoft’s February 2026 Patch Tuesday. Exploitability — Active exploitation confirmed; proof‑of‑concept code observed in the wild; patch released Feb 2026.
Affected Products — Microsoft Windows 10/11, Windows Server 2019‑2022, legacy Internet Explorer, Microsoft Office components that embed MSHTML, and any third‑party applications using the MSHTML rendering engine.
TPRM Impact — Vendors that bundle or depend on MSHTML inherit the same exposure, creating a cascade risk for downstream supply‑chain partners and SaaS providers. Unpatched endpoints can become footholds for APT28 to exfiltrate data or pivot across networks.
Recommended Actions — 1) Verify deployment of Microsoft’s February 2026 security update across all Windows assets. 2) Conduct an inventory of third‑party software that embeds MSHTML and confirm they are patched or mitigated. 3) Deploy detection signatures for known APT28 IOCs linked to this exploit. 4) Review and tighten web‑content filtering and application whitelisting policies. 5) Engage suppliers to confirm patch status and request evidence of remediation. Source: The Hacker News