Skip to content

CVE · Exploited · On CISA KEV

CVE-2026-21509

Microsoft Office Security Feature Bypass Vulnerability

7.8
CVSS 3.1
2
stories
JAN 26
added to KEV
Severity
7.8 High · vendor score
Vendor
Microsoft
Product
Office
Published
Jan 26, 2026
Added to KEV
Jan 26, 2026
KEV deadline
Feb 16, 2026
Ransomware use
Unknown
Weakness
CWE-807

What it is

Microsoft Office contains a security feature bypass vulnerability in which reliance on untrusted inputs in a security decision in Microsoft Office could allow an unauthorized attacker to bypass a security feature locally. Some of the impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version.

From CISA's Known Exploited Vulnerabilities catalog

Decipher coverage · 2 stories

Newest first ↑
  1. VulnerabilitiesMicrosoft Releases Emergency Patch for CVE-2026-21509The vulnerability (CVE-2026-21509) requires user interaction for an attack to succeed, with the most likely vector being an attacker sending a malicious Office file to a victim, who then opens it.DENNIS FISHER · 1 MIN
  2. VulnerabilitiesMicrosoft Fixes Six Exploited Bugs in February Patch Tuesday UpdatesThe exploited vulnerabilities in question exist across various products, from Microsoft Word to Windows Shell.DECIPHER · 3 MIN

Official references

6 sources

Registries

RegistryNVDScore, weakness and every referenceRegistryCVE.orgThe official CVE recordRegistryCISA KEVKnown exploited, with the federal deadline

Advisories, fixes & analysis

Vendor advisorymsrc.microsoft.com/update-guide/vulnerability/CVE-2026-21509Fixvicarius.io/vsociety/posts/cve-2026-21509-mitigation-script-microsoft-office-security-feature-bypass-vulnerabilityAnalysisvicarius.io/vsociety/posts/cve-2026-21509-detection-script-microsoft-office-security-feature-bypass-vulnerability