MSHTML 0 Day RCE Exploits Network Security Bypass

A critical security feature bypass vulnerability in the MSHTML Framework, tracked as CVE-2026-21513, which attackers exploited in the wild to bypass network protections and achieve remote code execution (RCE).

Released on February 10, 2026, this “Important” flaw affects numerous Windows versions and requires user interaction, enabling high-impact compromise via malicious HTML or .lnk files. Security teams must prioritize deployment as exploitation is confirmed.

The flaw stems from a failure of a protection mechanism (CWE-693) in MSHTML, the legacy rendering engine still used by the Windows Shell and apps to handle web content.

Attackers trick users into opening crafted files via email, links, or downloads, manipulating browser and shell behaviors to evade prompts such as Windows SmartScreen and to execute OS-level code.

This bypasses security UI, potentially leading to full RCE without authentication beyond user clicks.

Microsoft’s Threat Intelligence Center (MSTIC), Security Response Center (MSRC), and partners such as Google’s Threat Intelligence Group discovered and coordinated the fix.

Public disclosure and active exploits preceded patching, heightening urgency for enterprises.

Base Score Metrics

Temporal Score Metrics

Affected Platforms and Patches

Updates rolled out February 10, 2026, across 31 configurations, all marked “Required.” Builds vary by edition; hotpatching is supported on newer servers.​

Apply patches immediately via Windows Update or Catalog. Enable enhanced protections, such as Attack Surface Reduction rules, for MSHTML/Office files.

Monitor for anomalous .lnk/HTML handling and phishing. Until updated, block untrusted file execution in email gateways.

Enterprises should scan their environments using tools such as Qualys or Tenable to identify unpatched systems.

Site: cybersecuritypath.com