CVE-2026-21509

Published Jan 26, 2026

Last updated 4 months ago

Exploit known CVSS high 7.8

Microsoft Office

Zero-day

Supply chain

Overview

AI description

Automated description summarized from trusted sources.

CVE-2026-21509 is a security feature bypass vulnerability affecting various versions of Microsoft Office, including Office 2016, Office 2019, Office LTSC 2021, Office LTSC 2024, and Microsoft 365 Apps for Enterprise. This flaw allows attackers to circumvent built-in Object Linking and Embedding (OLE) security protections by exploiting how Office processes untrusted inputs during security decisions. The vulnerability enables malicious embedded objects to evade safeguards designed to prevent unsafe content processing or execution. Exploitation of CVE-2026-21509 typically occurs when a user opens a specially crafted Office document, often delivered via phishing emails. This can lead to the bypass of OLE mitigations, allowing for the execution of vulnerable COM/OLE controls that would otherwise be restricted. The vulnerability was actively exploited as a zero-day prior to the release of emergency out-of-band patches by Microsoft.

Description: Reliance on untrusted inputs in a security decision in Microsoft Office allows an unauthorized attacker to bypass a security feature locally.
Source: secure@microsoft.com
NVD status: Analyzed
Products: 365_apps, office, office_long_term_servicing_channel

Risk scores

CVSS 3.1

Type: Secondary
Base score: 7.8
Impact score: 5.9
Exploitability score: 1.8
Vector string: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Severity: HIGH

Known exploits

Data from CISA

Vulnerability name: Microsoft Office Security Feature Bypass Vulnerability
Exploit added on: Jan 26, 2026
Exploit action due: Feb 16, 2026
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Weaknesses

secure@microsoft.com: CWE-807

Hype score is a measure of social media activity compared against trending CVEs from the past 12 months. Max score 100.

Hype score: 4

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:x64:*",
            "matchCriteriaId": "3259EBFE-AE2D-48B8-BE9A-E22BBDB31378",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:x86:*",
            "matchCriteriaId": "CD25F492-9272-4836-832C-8439EBE64CCF",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:microsoft:office:2016:*:*:*:*:*:x64:*",
            "matchCriteriaId": "72324216-4EB3-4243-A007-FEF3133C7DF9",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:microsoft:office:2016:*:*:*:*:*:x86:*",
            "matchCriteriaId": "0FBB0E61-7997-4F26-9C07-54912D3F1C10",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:microsoft:office:2019:*:*:*:*:*:x64:*",
            "matchCriteriaId": "CF5DDD09-902E-4881-98D0-CB896333B4AA",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:microsoft:office:2019:*:*:*:*:*:x86:*",
            "matchCriteriaId": "26A3B226-5D7C-4556-9350-5222DC8EFC2C",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:microsoft:office_long_term_servicing_channel:2021:*:*:*:*:-:x64:*",
            "matchCriteriaId": "851BAC4E-9965-4F40-9A6C-B73D9004F4C1",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:microsoft:office_long_term_servicing_channel:2021:*:*:*:*:-:x86:*",
            "matchCriteriaId": "23B2FA23-76F4-4D83-A718-B8D04D7EA37B",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:microsoft:office_long_term_servicing_channel:2024:*:*:*:*:-:x64:*",
            "matchCriteriaId": "D31E509A-0B2E-4B41-88C4-0099E800AFE6",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:microsoft:office_long_term_servicing_channel:2024:*:*:*:*:-:x86:*",
            "matchCriteriaId": "017A7041-BEF1-4E4E-AC8A-EFC6AFEB01FE",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.