Microsoft fixed CVE-2026-21513 (CVSS 8.8) in February after confirming zero

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Microsoft Addresses CVE-2026-21513 Zero-Day Exploit in February Microsoft has resolved CVE-2026-21513, a vulnerability with a CVSS score of 8.8, after confirming its exploitation in the wild. The flaw, located in the MSHTML component and specifically in ieframe.dll, allowed attackers to bypass security measures. The vulnerability was published on February 10, 2026, and was added to the CISA KEV list on the same day. 2 sources 41