Microsoft has issued emergency out-of-band security updates to fix CVE-2026-21509, a high-severity security feature bypass zero-day vulnerability in Microsoft Office. This flaw is actively exploited in targeted attacks, allowing attackers to bypass critical protections like Mark-of-the-Web (MotW) and OLE mitigations.

Vulnerability Details

• CVE ID: CVE-2026-21509
• Severity: Important (CVSS: 7.8 High)
• Type: Security Feature Bypass
• Weakness: CWE-807 (Reliance on Untrusted Inputs in a Security Decision)
• Impact: Attackers can exploit this locally to bypass Office security features, potentially leading to malware execution or unauthorized access via crafted documents.
• Exploitation: Actively exploited in the wild (zero-day). Added to CISA's Known Exploited Vulnerabilities (KEV) Catalog on January 26, 2026. Federal agencies must patch by February 16, 2026.

Microsoft has been discreet about specific exploitation details, but the flaw likely involves tricking Office into trusting malicious inputs, bypassing protections on downloaded or embedded objects.

Affected Products

• Microsoft Office 2016 (including MSI-based installations)
• Microsoft Office 2019
• Microsoft Office LTSC 2021
• Microsoft Office LTSC 2024
• Microsoft 365 Apps for Enterprise

Note: Office 2021 and later versions receive automatic service-side protection but require an application restart.

Remediation Guide

Apply the emergency patches immediately:

1. For Microsoft 365 Apps and Office 2021+:
   • Protection is deployed server-side.
   • Restart all Office applications (Word, Excel, etc.) to activate the fix.
2. For Older Versions (e.g., Office 2016):
   • Install the specific security update:
     • Office 2016: KB5002713 (January 26, 2026 update)
   • Download from Microsoft Update Catalog or via Windows Update.
3. Verification:
   • Check installed updates in Office apps (File > Account > Update Options).
   • Use Microsoft Update Guide: CVE-2026-21509 Page
4. Additional Mitigations (if patching is delayed):
   • Enable Protected View for files from untrusted sources.
   • Block macros and external content.
   • Use Microsoft Defender for Office 365 for advanced threat protection.

MSP Patch Management: Best Strategies & Practices

Why This Matters

This zero-day highlights the ongoing risks in widely used productivity software. Attackers often target Office flaws for initial access in phishing campaigns. With active exploitation confirmed, delay in patching could expose organizations to significant risks.

Stay vigilant – always update promptly!

References:

• Microsoft Security Response Center
• NVD CVE Detail
• CISA KEV Catalog
• BleepingComputer Report