{"@odata.context":"https://api.msrc.microsoft.com/sug/v2.0/sugodata/v2.0/en-US/$metadata#vulnerability","@odata.count":1,"value":[{"id":"00000000-0000-0000-0000-0000ea26891e","releaseDate":"2026-02-10T08:00:00-08:00","cveNumber":"CVE-2026-21513","cveTitle":"MSHTML Framework Security Feature Bypass Vulnerability","releaseNumber":"2026-Feb","vulnType":"Security Vulnerability","latestRevisionDate":"2026-02-10T08:00:00-08:00","description":"<p>Protection mechanism failure in MSHTML Framework allows an unauthorized attacker to bypass a security feature over a network.</p>\n","cweList":["CWE-693: Protection Mechanism Failure"],"cweDetailsListForSearch":["cwe: CWE-693: Protection Mechanism Failure","cweUrl: https://cwe.mitre.org/data/definitions/693.html"],"unformattedDescription":"Protection mechanism failure in MSHTML Framework allows an unauthorized attacker to bypass a security feature over a network.","mitreText":"CVE-2026-21513","mitreUrl":"https://www.cve.org/CVERecord?id=CVE-2026-21513","publiclyDisclosed":"Yes","exploited":"Yes","latestSoftwareReleaseId":0,"latestSoftwareRelease":"Exploitation Detected","olderSoftwareReleaseId":0,"denialOfService":"N/A","tag":"MSHTML Framework","issuingCna":"Microsoft","issuingCnaId":100000001,"severityId":100000001,"severity":"Important","impactId":100000007,"impact":"Security Feature Bypass","langCode":"en-US","baseScore":"8.8","temporalScore":"7.7","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C","vectorStringSource":"Microsoft","isMariner":false,"customerActionRequired":true,"customerActionRequiredId":1,"cweDetailsList":[{"keys":["cwe","cweUrl"],"values":["CWE-693: Protection Mechanism Failure","https://cwe.mitre.org/data/definitions/693.html"]}],"articles":[{"articleType":"FAQ","description":"<p><strong>According to the CVSS metric, the attack vector is user interaction is required (UI:R). How could an attacker exploit this security feature bypass vulnerability?</strong></p>\n<p>An attacker could exploit this vulnerability by convincing a user to open a malicious HTML file or shortcut (.lnk) file delivered through a link, email attachment, or download. The specially crafted file manipulates browser and Windows Shell handling, causing the content to be executed by the operating system. This allows the attacker to bypass security features and potentially achieve code execution.</p>\n","ordinal":10000},{"title":"MSHTML Framework Security Feature Bypass Vulnerability","articleType":"100000000","description":"<p>Protection mechanism failure in MSHTML Framework allows an unauthorized attacker to bypass a security feature over a network.</p>\n","ordinal":10000},{"articleType":"FAQ","description":"<p><strong>What kind of security feature could be bypassed by successfully exploiting this vulnerability?</strong></p>\n<p>This update address a vulnerability that bypasses prompts when executing a file.</p>\n","ordinal":10000}],"revisions":[{"cveNumber":"CVE-2026-21513","version":1,"revisionDate":"2026-02-10T08:00:00-08:00","initialDate":"0001-01-01T00:00:00Z","description":"<p>Information published.</p>\n","unformattedDescription":"Information published.","notificationNeeded":false,"notificationSent":false,"sourceId":"74d711ea-0ff7-f011-93f7-000d3afbc7d7"}]}]}