MSHTML Framework Zero-Day Opens Door to Network-Based Security Bypass

Microsoft disclosed CVE-2026-21513, a critical MSHTML Framework security-feature bypass zero-day (CVSS 8.8) that can be exploited remotely via network-based vectors without special privileges and has been detected in the wild; Microsoft has issued an official fix and organizations are advised to patch immediately, monitor for MSHTML-related activity, and educate users to mitigate phishing-based exploitation.