APT28 Tied to CVE-2026-21513 MSHTML 0-Day Exploited Before Feb 2026 Patch Tuesday

Summary: Akamai identified a malicious artifact uploaded to VirusTotal on January 30, 2026, tied to infrastructure linked to the Russia-linked APT28 group, that exploits CVE-2026-21513, a high-severity MSHTML Framework security feature bypass (CVSS 8.8) Microsoft patched in its February 2026 Patch Tuesday update. The flaw stems from insufficient validation of the target URL in ieframe.dll's hyperlink navigation logic, letting attacker-controlled input reach code paths that invoke ShellExecuteExW and bypass Mark-of-the-Web and Internet Explorer Enhanced Security Configuration.
Why it matters: APT28 was already exploiting a separate Office flaw, CVE-2026-21509, when the same sample surfaced, and Akamai warns the vulnerable code path can be triggered by any component embedding MSHTML, so LNK-based phishing is not the only delivery route to expect.

Read the original at The Hacker News ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2026-21509 CVE-2026-21513
Related: APT28 Deploys PRISMEX Malware in Campaign Targeting Ukraine and NATO Allies Cyber Risks ·
Patch Tuesday, February 2026 Edition Cyber Risks ·
CVE-2026-21513: Microsoft MSHTML Framework Protection Mechanism Failure Vulnerability Known Exploited Vulnerabilities · Feb 10, 2026