Microsoft actively exploited vulnerabilities (multiple vulnerabilities)
Vulnerability
Summary
Hide ▲
Show ▼
Microsoft patched CVE-2026-21513, a high-severity MSHTML Framework security feature bypass that Microsoft said was already exploited as a zero-day in February 2026 Patch Tuesday. New reporting from Akamai says the flaw may have been exploited by APT28, using malicious HTML or LNK files to manipulate Windows Shell handling, bypass MotW and IE ESC, and potentially reach code execution outside the browser sandbox. Akamai tied the observed campaign to wellnesscaremed[.]com and said the vulnerable code path can be triggered through any component embedding MSHTML.
Related Happenings
Microsoft RDP file security guidance
Advisory/Mitigation
H score28
First: 14.07.2026 21:49
Last: 14.07.2026 21:49
Sources 1
About this happening:
Microsoft issued RDP mitigation guidance that restricts which .rdp files users can open and recommends migrating trusted publishers to SHA-256 thumbprints, reducing ph...
Microsoft RDP file security guidance
Advisory/MitigationAbout this happening: Microsoft issued RDP mitigation guidance that restricts which .rdp files users can open and recommends migrating trusted publishers to SHA-256 thumbprints, reducing ph...
Microsoft MDASH enters limited private preview for AI-driven vulnerability discovery at scale
Security Tool/Service
H score26
First: 13.05.2026 16:46
Last: 13.05.2026 16:46
Sources 1
About this happening:
Microsoft's MDASH has entered limited private preview, adding a new AI-driven vulnerability discovery service that can validate and prove exploitable defects at scale....
Microsoft MDASH enters limited private preview for AI-driven vulnerability discovery at scale
Security Tool/ServiceAbout this happening: Microsoft's MDASH has entered limited private preview, adding a new AI-driven vulnerability discovery service that can validate and prove exploitable defects at scale....
APT28 Windows Shell LNK campaign targeting Ukraine and E.U. nations
Campaign
H score39
First: 28.04.2026 08:50
Last: 28.04.2026 08:50
Sources 1
About this happening:
A December 2025 APT28 campaign targeted Ukraine and E.U. nations with a malicious Windows Shortcut (LNK) chain that bypassed Microsoft Defender SmartScreen...
APT28 Windows Shell LNK campaign targeting Ukraine and E.U. nations
CampaignAbout this happening: A December 2025 APT28 campaign targeted Ukraine and E.U. nations with a malicious Windows Shortcut (LNK) chain that bypassed Microsoft Defender SmartScreen...
Russia-linked DRILLAPP campaign targeting Ukrainian entities
Campaign
H score33
First: 16.03.2026 11:07
Last: 16.03.2026 11:07
Sources 1
About this happening:
A Russia-linked campaign is targeting Ukrainian entities with the DRILLAPP browser backdoor, expanding a covert operation that uses judicial and charity-themed l...
Russia-linked DRILLAPP campaign targeting Ukrainian entities
CampaignAbout this happening: A Russia-linked campaign is targeting Ukrainian entities with the DRILLAPP browser backdoor, expanding a covert operation that uses judicial and charity-themed l...
APT28 wellnesscaremed[.]com multistage LNK campaign
Campaign
H score36
First: 02.03.2026 12:36
Last: 02.03.2026 12:36
Sources 1
How related:
The LNK file initiates communication with the domain wellnesscaremed[.]com, which is attributed to APT28 and has been in extensive use for the campaign's multistage payloads.
About this happening:
An APT28-linked LNK/HTML delivery chain is being used for multistage payloads, indicating an ongoing phishing-style operation that can broaden exploitation paths. The...
APT28 wellnesscaremed[.]com multistage LNK campaign
CampaignHow related: The LNK file initiates communication with the domain wellnesscaremed[.]com, which is attributed to APT28 and has been in extensive use for the campaign's multistage payloads.
About this happening: An APT28-linked LNK/HTML delivery chain is being used for multistage payloads, indicating an ongoing phishing-style operation that can broaden exploitation paths. The...
Timeline
-
11.02.2026 12:22 4 articles · 5mo ago
Microsoft releases fixes for six actively exploited vulnerabilities
Initial DisclosureMicrosoft releases security updates for 59 flaws across its software, including six vulnerabilities that were actively exploited in the wild across Windows Shell, MSHTML Framework, Microsoft Office Word, Desktop Window Manager, Windows Remote Access Connection Manager, and Windows Remote Desktop. CISA adds all six CVEs to the Known Exploited Vulnerabilities (KEV) catalog and requires Federal Civilian Executive Branch (FCEB) agencies to apply the fixes by March 3, 2026.
Show sources
- Microsoft Patches 59 Vulnerabilities Including Six Actively Exploited Zero-Days — thehackernews.com — 11.02.2026 12:22
- Microsoft Patches 59 Vulnerabilities Including Six Actively Exploited Zero-Days — thehackernews.com — 11.02.2026 12:22
- Patch Tuesday, February 2026 Edition — krebsonsecurity.com — 10.02.2026 23:49
- APT28 Tied to CVE-2026-21513 MSHTML 0-Day Exploited Before Feb 2026 Patch Tuesday — thehackernews.com — 02.03.2026 12:36