CVE-2026-21510Vulnerability
Microsoft Windows Shell Protection Mechanism Failure Vulnerability
Reported by 4 independent sources · first reported by Tenable · last reported
Last reported 4 days ago
Fix due 3 Mar 2026
Used by ransomware: not knownCISA KEV catalogue
higher than 97% of CVEsFIRST EPSS, as of 23 Oct 2026
What the reports say
5 reports, newest first · the exact sentence from each-
Incomplete security patches show hackers where to look next“Microsoft patched CVE-2026-21510, a Windows Shell vulnerability the APT28 group was exploiting in the wild, in February 2026.”
-
Security patches need patches now that attackers have AI“For example, Russian government cyberspies exploited a zero-day Windows Shell security bypass bug, CVE-2026-21510, at least a month before Microsoft patched the flaw in February.”
-
October 2026 Patch Tuesday: 1,413 Flaws, 3 Zero-Days“Windows Shell has been targeted before this year: CVE-2026-21510 was patched as an exploited zero-day in February 2026 Patch Tuesday.”
-
Microsoft fixes exploited Mark of the Web bypass vulnerability (CVE-2026-96951)““The other two were CVE-2026-21510, which is linked to the advanced persistent threat group APT28 (also known as Fancy Bear), and CVE-2026-32202, which was a fix for an incomplete patch for CVE-2026-21510.”
-
Microsoft’s October 2026 Patch Tuesday addresses 1407 CVEs (CVE-2026-96951)“This is the third flaw in Windows Shell that was exploited in the wild in 2026: CVE-2026-21510 was patched in February 2026’s Patch Tuesday while CVE-2026-32202 was patched in April 2026’s Patch Tuesday.”
Indicators reported together
named in the same reportsAlso named with it: CVE-2026-32202, CVE-2026-96951, CVE-2026-108398, CVE-2026-70571, CVE-2026-77900, CVE-2026-69435, CVE-2026-94510, CVE-2026-88131, CVE-2026-70279, CVE-2026-70242, CVE-2026-70291, CVE-2026-88156, CVE-2026-97016, CVE-2026-97749, CVE-2026-88178, CVE-2026-102866, CVE-2026-96207, CVE-2026-70147, CVE-2026-70153, CVE-2026-100219
Thanks — we review every report.