CVE-2026-21513: high-severity vulnerability in Microsoft Windows 10 Version 1607
MSHTML Framework Security Feature Bypass Vulnerability
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Prioritize patching. It under exploitation confirmed by CISA and has an official Brazilian government alert.
Brazil's federal government published an alert, recommendation or bulletin that cites this vulnerability.
- CTIR Gov · ALERTA 07/2026Vulnerabilidade crítica no Windowsread on gov.br ↗
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
A flaw in MSHTML Framework allows attackers to bypass a built-in security protection through a network connection. This means malicious actors could circumvent safeguards designed to protect your system.
A security feature bypass vulnerability in MSHTML Framework (CWE-693: Protection Mechanism Failure) permits remote attackers to circumvent protection mechanisms without authentication. The attack vector is network-based, with no user interaction required, resulting in potential compromise of the intended security controls.
The full analysis of this CVE is available in Portuguese →
In the same product, most dangerous first.