CVE-2026-21509: Microsoft Office Security Feature Bypass Vulnerability
Vulnerability summary
CVE-2026-21509 is a high (CVSS 7.8) vulnerability in Microsoft Office. It is known to be exploited: CISA and CIRCL list it, first on 26-01-2026. EPSS estimates a 70.80% chance of exploitation in the next 30 days, higher than 99.4% of scored vulnerabilities.
Timeline
- 26-01-2026PublishedVulnerability first disclosed.
- 26-01-2026Added to CISA KEVMicrosoft Office Security Feature Bypass Vulnerability
- 26-01-2026Added to CIRCL KEVAdded to the CIRCL known exploited vulnerabilities catalog.
- 16-02-2026CISA remediation dueApply mitigations per vendor instructions.
- 30-07-2026Last modifiedVulnerability information updated.
Description
Reliance on untrusted inputs in a security decision in Microsoft Office allows an unauthorized attacker to bypass a security feature locally.
CVSS metrics
2 scores · 2 sources · 1 version- NVDNIST7.8HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS trend
Probability
70.80%
Chance of exploitation in the next 30 days
Percentile
99%
Versus all other CVEs
30-day change
-1.76 pp
From 72.55% on 21-09-2026
Known exploited
Compare KEV catalogs
CISA KEVListed- Added
- 26-01-2026
- Federal due date
- 16-02-2026
CIRCLListed- Added
- 26-01-2026
CISA required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. nvd.nist.gov/vuln/detail/CVE-2026-21509
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Microsoft8 products
- 365_appsna
- microsoft 365 apps for enterprise≥ 16.0.1, < https://aka.ms/OfficeSecurityReleases
- microsoft office 2016≥ 16.0.0, < 16.0.5539.1001
- microsoft office 2019≥ 19.0.0, < 16.0.10417.20095
- microsoft office ltsc 2021≥ 16.0.1, < https://aka.ms/OfficeSecurityReleases
1 vendor · 8 products
References
4 links
- www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-21509Government ResourceUS Government Resource
- www.vicarius.io/vsociety/…Third Party Advisory