What is the CVSS score of CVE-2026-21509?

CVE-2026-21509 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 9.3%.

Which versions of 365 Apps are affected by CVE-2026-21509?

CVE-2026-21509 is a HIGH severity vulnerability in Microsoft Office that allows local attackers to bypass security features through manipulated inputs.. A patch is available.

Is CVE-2026-21509 being actively exploited?

Yes, CVE-2026-21509 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, confirming active in-the-wild exploitation. Immediate patching is required.

How to fix or mitigate CVE-2026-21509?

Within 24 hours: Assess inventory of Microsoft Office deployments and identify business-critical systems; communicate vulnerability to all stakeholders and restrict Office file sharing from untrusted sources. Within 7 days: Implement compensating controls listed below; enhance monitoring for suspicious Office file activity and privilege escalation attempts; conduct threat hunting for indicators of compromise. Within 30 days: Continuously monitor for patch availability from Microsoft and deploy immediately upon release; review and strengthen email filtering and attachment policies; conduct security awareness training on file handling risks.

365 Apps CVE-2026-21509

HIGH

Reliance on Untrusted Inputs in a Security Decision (CWE-807)

2026-01-26 secure@microsoft.com

Microsoft 365 Apps Office Office Long Term Servicing Channel Authentication Bypass

7.8

CVSS 3.1 · Vendor: microsoft

Severity by source

Vendor (microsoft) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from Vendor (microsoft) · only source for this CVE.

CVSS VectorVendor: microsoft

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:00 vuln.today

Added to CISA KEV

Feb 11, 2026 - 15:40 cisa

CISA KEV

CIRCL Exploitation Confirmed

Feb 11, 2026 - 15:40 circl

CIRCL KEV

CVE Published

Jan 26, 2026 - 18:16 nvd

HIGH 7.8

DescriptionCVE.org

Reliance on untrusted inputs in a security decision in Microsoft Office allows an unauthorized attacker to bypass a security feature locally.

AnalysisAI

Microsoft Office contains a security feature bypass (CVE-2026-21509, CVSS 7.8) where reliance on untrusted inputs in security decisions allows local attackers to bypass protections designed to prevent execution of malicious content. KEV-listed with EPSS 9.3%, this vulnerability enables attackers to circumvent Office security features like Protected View or macro restrictions through crafted documents.

Technical ContextAI

Office's security model uses metadata and file attributes to determine whether to apply security restrictions (Protected View, macro blocking, etc.). This vulnerability allows attackers to manipulate these inputs so that Office treats malicious documents as trusted, bypassing security features that would normally prevent code execution. This is a common technique in the attack chain: first bypass protections, then exploit a separate vulnerability for code execution.

RemediationAI

Apply Microsoft security update immediately. Enforce Attack Surface Reduction (ASR) rules for Office. Block macros from internet-sourced documents via Group Policy. Enable Protected View for all external documents. User awareness training on document-based threats.