CVE-2026-21513: APT28 Exploits MSHTML Zero-Day in Targeted Attacks
A Russia-linked threat actor widely tracked as APT28 leveraged a zero-day vulnerability in Microsoft’s MSHTML engine, tracked as CVE-2026-21513, in targeted operations before a security patch was made available. The vulnerability enabled remote code execution through crafted content rendered by the Windows MSHTML component, which remains embedded across supported Windows systems. The exploitation occurred in targeted spear-phishing campaigns aimed at diplomatic and defense-aligned organizations.