high7.8Known exploited
CVE-2026-21509
Microsoft Office Security Feature Bypass Vulnerability
Exploited in the wild
This vulnerability is on the CISA Known Exploited Vulnerabilities list, added 2026-01-26. Federal due date: 2026-02-16.
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Impact
Microsoft Office contains a security feature bypass vulnerability in which reliance on untrusted inputs in a security decision in Microsoft Office could allow an unauthorized attacker to bypass a security feature locally. Some of the impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Microsoft | 365 Apps | All versions |
| Microsoft | Office | Versions 2016, 2019 |
| Microsoft | Office Long Term Servicing Channel | Versions 2021, 2024 |
Weakness classification
References
- NVD record
- CVE.org record
- CISA KEV catalog
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21509
- https://www.vicarius.io/vsociety/posts/cve-2026-21509-detection-script-microsoft-office-security-feature-bypass-vulnerability
- https://www.vicarius.io/vsociety/posts/cve-2026-21509-mitigation-script-microsoft-office-security-feature-bypass-vulnerability
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-21509