{"schema":"vulnpedia.research/1","cve":"CVE-2026-21513","references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21513","tags":["vendor-advisory","patch","Vendor Advisory","KEV report"],"source":"mitre","sourceId":"microsoft","modified":"2026-08-19T16:25:57.019Z","origins":[{"source":"mitre","sourceId":"microsoft","modified":"2026-08-19T16:25:57.019Z","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21513"},{"source":"nvd","sourceId":"CVE-2026-21513","modified":"2026-06-17T10:18:45.540","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21513"},{"source":"vulncheck-kev","sourceId":"CVE-2026-21513","modified":"2026-02-10T00:00:00Z","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21513"}]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-21513","tags":["government-resource","US Government Resource"],"source":"mitre","sourceId":"CISA-ADP","modified":"2026-02-26T14:44:46.806Z","origins":[{"source":"mitre","sourceId":"CISA-ADP","modified":"2026-02-26T14:44:46.806Z","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-21513"},{"source":"nvd","sourceId":"CVE-2026-21513","modified":"2026-06-17T10:18:45.540","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-21513"}]},{"url":"https://www.vicarius.io/vsociety/posts/cve-2026-21513-detection-script-security-feature-bypass-vulnerability-in-mshtml-framework","tags":["Third Party Advisory"],"source":"mitre","sourceId":"CVE","modified":"2026-03-27T21:04:53.710Z","origins":[{"source":"mitre","sourceId":"CVE","modified":"2026-03-27T21:04:53.710Z","url":"https://www.vicarius.io/vsociety/posts/cve-2026-21513-detection-script-security-feature-bypass-vulnerability-in-mshtml-framework"},{"source":"nvd","sourceId":"CVE-2026-21513","modified":"2026-06-17T10:18:45.540","url":"https://www.vicarius.io/vsociety/posts/cve-2026-21513-detection-script-security-feature-bypass-vulnerability-in-mshtml-framework"}]},{"url":"https://www.vicarius.io/vsociety/posts/cve-2026-21513-mitigation-script-security-feature-bypass-vulnerability-in-mshtml-framework","tags":["Mitigation","Third Party Advisory"],"source":"mitre","sourceId":"CVE","modified":"2026-03-27T21:04:53.710Z","origins":[{"source":"mitre","sourceId":"CVE","modified":"2026-03-27T21:04:53.710Z","url":"https://www.vicarius.io/vsociety/posts/cve-2026-21513-mitigation-script-security-feature-bypass-vulnerability-in-mshtml-framework"},{"source":"nvd","sourceId":"CVE-2026-21513","modified":"2026-06-17T10:18:45.540","url":"https://www.vicarius.io/vsociety/posts/cve-2026-21513-mitigation-script-security-feature-bypass-vulnerability-in-mshtml-framework"}]},{"source":"euvd","sourceId":"EUVD-2026-7342","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-7342","tags":["ADVISORY"],"origins":[{"source":"euvd","sourceId":"EUVD-2026-7342","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-7342"}]},{"url":"https://vulncheck.com/kev","tags":["ADVISORY"],"source":"vulncheck-kev","sourceId":"CVE-2026-21513","modified":"2026-02-10T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-21513","modified":"2026-02-10T00:00:00Z","url":"https://vulncheck.com/kev"}]},{"url":"https://api.msrc.microsoft.com/cvrf/v3.0/cvrf/2026-Feb","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-21513","modified":"2026-02-10T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-21513","modified":"2026-02-10T00:00:00Z","url":"https://api.msrc.microsoft.com/cvrf/v3.0/cvrf/2026-Feb"}]},{"url":"https://docs.google.com/spreadsheets/d/1lkNJ0uQwbeC1ZTRrxdtuPLCIl7mlUreoKfSIgajnSyY/edit","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-21513","modified":"2026-02-10T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-21513","modified":"2026-02-10T00:00:00Z","url":"https://docs.google.com/spreadsheets/d/1lkNJ0uQwbeC1ZTRrxdtuPLCIl7mlUreoKfSIgajnSyY/edit"}]},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-21513","modified":"2026-02-10T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-21513","modified":"2026-02-10T00:00:00Z","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json"}]},{"url":"https://www.akamai.com/blog/security-research/inside-the-fix-cve-2026-21513-mshtml-exploit-analysis","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-21513","modified":"2026-02-10T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-21513","modified":"2026-02-10T00:00:00Z","url":"https://www.akamai.com/blog/security-research/inside-the-fix-cve-2026-21513-mshtml-exploit-analysis"}]},{"url":"https://foresiet.com/blog/cve-2026-21513-apt28-mshtml-exploit/","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-21513","modified":"2026-02-10T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-21513","modified":"2026-02-10T00:00:00Z","url":"https://foresiet.com/blog/cve-2026-21513-apt28-mshtml-exploit/"}]},{"url":"https://asec.ahnlab.com/en/92906/","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-21513","modified":"2026-02-10T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-21513","modified":"2026-02-10T00:00:00Z","url":"https://asec.ahnlab.com/en/92906/"}]},{"url":"https://www.recordedfuture.com/blog/february-2026-cve-landscape","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-21513","modified":"2026-02-10T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-21513","modified":"2026-02-10T00:00:00Z","url":"https://www.recordedfuture.com/blog/february-2026-cve-landscape"}]},{"url":"https://medium.com/@nshcthreatrecon/monthly-threat-actor-group-intelligence-report-february-2026-3238aa411dab","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-21513","modified":"2026-02-10T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-21513","modified":"2026-02-10T00:00:00Z","url":"https://medium.com/@nshcthreatrecon/monthly-threat-actor-group-intelligence-report-february-2026-3238aa411dab"}]},{"url":"https://www.trendmicro.com/en_us/research/26/c/pawn-storm-targets-govt-infra.html","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-21513","modified":"2026-02-10T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-21513","modified":"2026-02-10T00:00:00Z","url":"https://www.trendmicro.com/en_us/research/26/c/pawn-storm-targets-govt-infra.html"}]},{"url":"https://www.broadcom.com/support/security-center/protection-bulletin/prismex-malware-distributed-by-the-swallowtail-apt","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-21513","modified":"2026-02-10T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-21513","modified":"2026-02-10T00:00:00Z","url":"https://www.broadcom.com/support/security-center/protection-bulletin/prismex-malware-distributed-by-the-swallowtail-apt"}]},{"url":"https://medium.com/@nshcthreatrecon/weekly-threat-intelligence-report-30-mar-2026-d811e5508cba","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-21513","modified":"2026-02-10T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-21513","modified":"2026-02-10T00:00:00Z","url":"https://medium.com/@nshcthreatrecon/weekly-threat-intelligence-report-30-mar-2026-d811e5508cba"}]},{"url":"https://www.akamai.com/blog/security-research/2026/apr/incomplete-patch-apt28s-zero-day-cve-2026-3220","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-21513","modified":"2026-02-10T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-21513","modified":"2026-02-10T00:00:00Z","url":"https://www.akamai.com/blog/security-research/2026/apr/incomplete-patch-apt28s-zero-day-cve-2026-3220"}]},{"url":"https://ics-cert.kaspersky.com/publications/reports/2026/05/21/apt-and-financial-attacks-on-industrial-organizations-in-q1-2026/","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-21513","modified":"2026-02-10T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-21513","modified":"2026-02-10T00:00:00Z","url":"https://ics-cert.kaspersky.com/publications/reports/2026/05/21/apt-and-financial-attacks-on-industrial-organizations-in-q1-2026/"}]},{"url":"https://www.proofpoint.com/us/blog/threat-insight/more-cves-same-playbook-2026-vulnerability-exploitation-wild","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-21513","modified":"2026-02-10T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-21513","modified":"2026-02-10T00:00:00Z","url":"https://www.proofpoint.com/us/blog/threat-insight/more-cves-same-playbook-2026-vulnerability-exploitation-wild"}]},{"url":"https://www.recordedfuture.com/blog/june-2026-cve-landscape","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-21513","modified":"2026-02-10T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-21513","modified":"2026-02-10T00:00:00Z","url":"https://www.recordedfuture.com/blog/june-2026-cve-landscape"}]},{"url":"https://www.rapid7.com/blog/post/tr-exposed-webdav-malware-delivery-lab-analysis/","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-21513","modified":"2026-02-10T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-21513","modified":"2026-02-10T00:00:00Z","url":"https://www.rapid7.com/blog/post/tr-exposed-webdav-malware-delivery-lab-analysis/"}]}],"packages":[],"pocCandidates":[],"cataloguedPoc":[],"vendorStatements":[],"exploitationSources":[{"source":"vulncheck-kev","sourceId":"CVE-2026-21513","catalog":"VulnCheck KEV","kind":"catalogue","url":"https://vulncheck.com/kev","dateAdded":"2026-02-10T00:00:00Z","modified":"2026-02-10T00:00:00Z","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Unknown","reportedByVulncheckCanaries":false,"vendorProject":"Microsoft","product":"Windows","dueDate":"2026-03-03T00:00:00Z","cisaDateAdded":"2026-02-10T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-21513","modified":"2026-02-10T00:00:00Z","url":"https://vulncheck.com/kev"}]},{"source":"vulncheck-kev","sourceId":"CVE-2026-21513","catalog":"VulnCheck KEV","kind":"report","url":"https://api.msrc.microsoft.com/cvrf/v3.0/cvrf/2026-Feb","dateAdded":"2026-02-10T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-21513","url":"https://api.msrc.microsoft.com/cvrf/v3.0/cvrf/2026-Feb"},{"source":"vulncheck-kev","sourceId":"CVE-2026-21513","url":"https://docs.google.com/spreadsheets/d/1lkNJ0uQwbeC1ZTRrxdtuPLCIl7mlUreoKfSIgajnSyY/edit"},{"source":"vulncheck-kev","sourceId":"CVE-2026-21513","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21513"},{"source":"vulncheck-kev","sourceId":"CVE-2026-21513","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json"}]},{"source":"vulncheck-kev","sourceId":"CVE-2026-21513","catalog":"VulnCheck KEV","kind":"report","url":"https://www.akamai.com/blog/security-research/inside-the-fix-cve-2026-21513-mshtml-exploit-analysis","dateAdded":"2026-02-20T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-21513","url":"https://www.akamai.com/blog/security-research/inside-the-fix-cve-2026-21513-mshtml-exploit-analysis"}]},{"source":"vulncheck-kev","sourceId":"CVE-2026-21513","catalog":"VulnCheck KEV","kind":"report","url":"https://foresiet.com/blog/cve-2026-21513-apt28-mshtml-exploit/","dateAdded":"2026-03-03T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-21513","url":"https://foresiet.com/blog/cve-2026-21513-apt28-mshtml-exploit/"}]},{"source":"vulncheck-kev","sourceId":"CVE-2026-21513","catalog":"VulnCheck KEV","kind":"report","url":"https://asec.ahnlab.com/en/92906/","dateAdded":"2026-03-12T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-21513","url":"https://asec.ahnlab.com/en/92906/"},{"source":"vulncheck-kev","sourceId":"CVE-2026-21513","url":"https://www.recordedfuture.com/blog/february-2026-cve-landscape"}]},{"source":"vulncheck-kev","sourceId":"CVE-2026-21513","catalog":"VulnCheck KEV","kind":"report","url":"https://medium.com/@nshcthreatrecon/monthly-threat-actor-group-intelligence-report-february-2026-3238aa411dab","dateAdded":"2026-03-16T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-21513","url":"https://medium.com/@nshcthreatrecon/monthly-threat-actor-group-intelligence-report-february-2026-3238aa411dab"}]},{"source":"vulncheck-kev","sourceId":"CVE-2026-21513","catalog":"VulnCheck KEV","kind":"report","url":"https://www.trendmicro.com/en_us/research/26/c/pawn-storm-targets-govt-infra.html","dateAdded":"2026-03-26T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-21513","url":"https://www.trendmicro.com/en_us/research/26/c/pawn-storm-targets-govt-infra.html"}]},{"source":"vulncheck-kev","sourceId":"CVE-2026-21513","catalog":"VulnCheck KEV","kind":"report","url":"https://www.broadcom.com/support/security-center/protection-bulletin/prismex-malware-distributed-by-the-swallowtail-apt","dateAdded":"2026-03-30T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-21513","url":"https://www.broadcom.com/support/security-center/protection-bulletin/prismex-malware-distributed-by-the-swallowtail-apt"}]},{"source":"vulncheck-kev","sourceId":"CVE-2026-21513","catalog":"VulnCheck KEV","kind":"report","url":"https://medium.com/@nshcthreatrecon/weekly-threat-intelligence-report-30-mar-2026-d811e5508cba","dateAdded":"2026-04-03T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-21513","url":"https://medium.com/@nshcthreatrecon/weekly-threat-intelligence-report-30-mar-2026-d811e5508cba"}]},{"source":"vulncheck-kev","sourceId":"CVE-2026-21513","catalog":"VulnCheck KEV","kind":"report","url":"https://www.akamai.com/blog/security-research/2026/apr/incomplete-patch-apt28s-zero-day-cve-2026-3220","dateAdded":"2026-04-23T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-21513","url":"https://www.akamai.com/blog/security-research/2026/apr/incomplete-patch-apt28s-zero-day-cve-2026-3220"}]},{"source":"vulncheck-kev","sourceId":"CVE-2026-21513","catalog":"VulnCheck KEV","kind":"report","url":"https://ics-cert.kaspersky.com/publications/reports/2026/05/21/apt-and-financial-attacks-on-industrial-organizations-in-q1-2026/","dateAdded":"2026-05-21T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-21513","url":"https://ics-cert.kaspersky.com/publications/reports/2026/05/21/apt-and-financial-attacks-on-industrial-organizations-in-q1-2026/"}]},{"source":"vulncheck-kev","sourceId":"CVE-2026-21513","catalog":"VulnCheck KEV","kind":"report","url":"https://www.proofpoint.com/us/blog/threat-insight/more-cves-same-playbook-2026-vulnerability-exploitation-wild","dateAdded":"2026-05-27T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-21513","url":"https://www.proofpoint.com/us/blog/threat-insight/more-cves-same-playbook-2026-vulnerability-exploitation-wild"}]},{"source":"vulncheck-kev","sourceId":"CVE-2026-21513","catalog":"VulnCheck KEV","kind":"report","url":"https://www.recordedfuture.com/blog/june-2026-cve-landscape","dateAdded":"2026-07-10T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-21513","url":"https://www.recordedfuture.com/blog/june-2026-cve-landscape"}]},{"source":"vulncheck-kev","sourceId":"CVE-2026-21513","catalog":"VulnCheck KEV","kind":"report","url":"https://www.rapid7.com/blog/post/tr-exposed-webdav-malware-delivery-lab-analysis/","dateAdded":"2026-07-20T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-21513","url":"https://www.rapid7.com/blog/post/tr-exposed-webdav-malware-delivery-lab-analysis/"}]}]}