CVE intelligenceCISA KEV

CVE-2026-21509

Microsoft Office Security Feature Bypass Vulnerability

Published Jan 26, 2026Sources checked Oct 28, 2026

7.8HIGHCVSS out of 10

What this means

Actively exploited

CISA lists CVE-2026-21509 in its Known Exploited Vulnerabilities catalog, which means exploitation has been observed. The entry applies to Microsoft Office.

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CISA KEVListedObserved exploitation

EPSS70.8%Estimated 30-day exploitation probability

Ransomware useNot markedCISA KEV ransomware field

Threat actors1Source-linked actor relationships

Overview

What is CVE-2026-21509?

Reliance on untrusted inputs in a security decision in Microsoft Office allows an unauthorized attacker to bypass a security feature locally.

Source: NVD

CISA says:Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.CISA catalog due date Feb 16, 2026