{"id":"CVE-2026-21509","kind":"vulnerability","aliases":["CVE-2026-21509"],"related":[],"title":"Reliance on untrusted inputs in a security decision in Microsoft Office allows an unauthorized attacker to bypass a…","description":"Microsoft Office contains a security feature bypass vulnerability in which reliance on untrusted inputs in a security decision in Microsoft Office could allow an unauthorized attacker to bypass a security feature locally. Some of the impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version.\n\nCISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","summary":"Microsoft Office contains a security feature bypass where an untrusted input is relied on in a security decision, letting an unauthorized attacker get around a protection. CISA lists it as actively exploited in the wild.","severity":"high","cvss":7.8,"epss":null,"exploited":true,"exploited_at":"2026-01-26T00:00:00+00:00","products":[{"name":"Microsoft Office","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"microsoft 365 apps","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"microsoft office","fixed":[],"affected":"= 2016","ecosystem":"vendor"},{"name":"microsoft office","fixed":[],"affected":"= 2019","ecosystem":"vendor"},{"name":"microsoft office long term servicing channel","fixed":[],"affected":"= 2021","ecosystem":"vendor"},{"name":"microsoft office long term servicing channel","fixed":[],"affected":"= 2024","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","microsoft-office","vendor","windows"],"not_affected_if":["unknown"],"how_to_check":null,"fix":"Apply the mitigations in Microsoft's vendor instructions, or discontinue use of the affected Office product if mitigations are unavailable (per CISA required action). Some affected products may be end-of-life; move to a supported version.","status":"open","published_at":"2026-01-26T00:00:00+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:42:32+00:00","updated_at":"2026-10-23T23:44:51+00:00","category":"vendor","confidence":0.4,"triage":{"at":"2026-10-23T20:42:32Z","model":"claude-haiku-5-5","output":{"fix":"Apply the mitigations in Microsoft's vendor instructions, or discontinue use of the affected Office product if mitigations are unavailable (per CISA required action). Some affected products may be end-of-life; move to a supported version.","reach":"local","summary":"Microsoft Office contains a security feature bypass where an untrusted input is relied on in a security decision, letting an unauthorized attacker get around a protection. CISA lists it as actively exploited in the wild.","category":"vendor","who_cares":["microsoft-office","windows"],"confidence":0.4,"needs_auth":"unknown","worst_case":"Attacker bypasses an Office security feature locally, enabling further compromise of the machine.","analyst_note":"Find the Microsoft Security Response Center advisory for CVE-2026-21509 to get affected versions, patch builds and the exact mitigation steps; sources only give the KEV entry.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["unknown"],"user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000452,"input_tokens":2603,"output_tokens":383,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-01':161C '-2026':19A,22A '-21509':20A,23A '22':160C '365':27A 'action':151C 'activ':81B 'advis':139C 'allow':12A,108C 'and/or':131C,143C 'appli':152C 'applic':158C 'apps':28A 'around':74B 'attack':15A,72B,111C 'bod':159C 'bypass':17A,57B,92C,113C 'channel':38A,44A 'cisa':77B,149C 'cloud':164C 'contain':53B,88C 'could':107C,124C 'cve':18A,21A 'decis':8A,68B,103C 'discontinu':141C,167C 'end':127C,133C 'end-of-lif':126C 'end-of-servic':132C 'eo':136C 'eol':130C 'exploit':45B,82B 'featur':56B,91C,116C 'follow':157C 'get':73B 'guidanc':162C 'impact':121C 'input':4A,61B,99C 'instruct':156C 'let':69B 'life':129C 'list':78B 'local':117C 'long':35A,41A 'microsoft':10A,24A,26A,29A,31A,33A,39A,47B,51B,86C,105C 'microsoft-offic':46B 'mitig':153C,173C 'offic':11A,48B,52B,87C,106C 'office':25A,30A,32A,34A,40A 'per':154C 'product':122C,171C 'protect':76B 'reli':63B 'relianc':1A,96C 'requir':150C 'secur':7A,55B,67B,90C,102C,115C 'servic':135C,165C 'servicing':37A,43A 'support':147C 'term':36A,42A 'transit':144C 'unauthor':14A,71B,110C 'unavail':175C 'untrust':3A,60B,98C 'use':142C,168C 'user':137C 'vendor':49B,155C 'version':148C 'vulner':93C 'wild':85B 'window':50B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-01-26T00:00:00+00:00","kev":{"dateAdded":"2026-01-26","dueDate":"2026-02-16","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2026-21509","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-21509","severity":null,"published_at":"2026-01-26T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T14:39:38+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-21509","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-21509","severity":null,"published_at":"2026-01-26T18:16:38+00:00","modified_at":"2026-06-25T05:16:53+00:00","first_seen_at":"2026-10-23T23:44:51+00:00","fetched_at":"2026-10-23T23:44:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}