This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.

[TLP:CLEAR] Microsoft Windows fixes a high-severity vulnerability

As part of its Patch Tuesday, Microsoft released fixes for a high-severity vulnerability in the MSHTML framework [1]. According to new findings by Akamai, this vulnerability may have been exploited by a Russia-linked state-sponsored actor known as APT28 [2]. The vulnerability has been added to CISA's Known Exploited Vulnerabilities catalog [3].

Microsoft Windows MSHTML Framework - security feature bypass (CVE-2026-21513)
CVSS 8.8 (High)

Allows an unauthenticated remote attacker to bypass protective security mechanisms (MotW/IE ESC) and potentially execute arbitrary code outside the sandbox via ShellExecuteExW, due to insufficient validation of the target URL in the hyperlink navigation logic of the MSHTML Framework (ieframe.dll) [1][2].

The vulnerability is present in product:

  • Microsoft Windows;

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

More information:

The vulnerability was publicly disclosed 10. 2. 2026.

By CESNET, z.s.p.o. Michaela Jarošová on 3. 3. 2026.

CESNET, z.s.p.o. Logo