Office
CVE-2026-21509
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessUser opens malicious Office document
-
ExploitAttacker-controlled input bypasses security decision logic
-
ImpactUnauthorized access to sensitive data and system modifications
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Trusted input validation
|
| Exploitation Conditions | User interaction required to open crafted Office document. Attacker relies on document macros or embedded content that exploits untrusted input handling in Office's security decision mechanism. No authentication bypass; local execution on victim's machine. |
| Impact | CVSS 7.8 (High). KEV-listed — actively exploited. EPSS 9.3%. Requires user to open malicious document. Security feature bypass — often chained with other vulnerabilities. High value for phishing campaigns and targeted attacks. |
| Exploit ScenarioDerived | An attacker crafts a malicious Office document with manipulated metadata that causes Office to skip security checks (Protected View, macro warnings). The document is delivered via phishing email. When the victim opens it, instead of opening in the restricted Protected View, the document opens with full privileges, enabling embedded macros or exploits to execute without user warnings. This is typically chained with additional payloads for full system compromise. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
Microsoft Office contains a security feature bypass (CVE-2026-21509, CVSS 7.8) where reliance on untrusted inputs in security decisions allows local attackers to bypass protections designed to prevent execution of malicious content. KEV-listed with EPSS 9.3%, this vulnerability enables attackers to circumvent Office security features like Protected View or macro restrictions through crafted documents.
Earlier versions of this analysis (1)
Microsoft Office relies on untrusted inputs (CWE-807) when making security decisions, allowing local attackers to bypass security features such as Protected View, Mark of the Web, or macro execution restrictions through specially crafted documents.
RemediationAI
Apply Microsoft security update immediately. Enforce Attack Surface Reduction (ASR) rules for Office. Block macros from internet-sourced documents via Group Policy. Enable Protected View for all external documents. User awareness training on document-based threats.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 6 packages in microsoft
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Office's security model uses metadata and file attributes to determine whether to apply security restrictions (Protected View, macro blocking, etc.). This vulnerability allows attackers to manipulate these inputs so that Office treats malicious documents as trusted, bypassing security features that would normally prevent code execution. This is a common technique in the attack chain: first bypass protections, then exploit a separate vulnerability for code execution.
Know when Office gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from Vendor (microsoft) · only source for this CVE.
CVSS VectorVendor: microsoft
Lifecycle Timeline
3DescriptionCVE.org
Reliance on untrusted inputs in a security decision in Microsoft Office allows an unauthorized attacker to bypass a security feature locally.
Executive ViewAI
CVE-2026-21509 is a HIGH severity vulnerability in Microsoft Office that allows local attackers to bypass security features through manipulated inputs. This is actively being exploited in the wild, posing immediate risk to any organization using Microsoft Office, particularly those with sensitive data or compliance requirements.
Disable potentially vulnerable Office features (macros, dynamic data exchange) where operationally feasible; restrict Office application execution via application whitelisting on high-value systems; implement network segmentation to limit lateral movement from compromised Office instances; enforce strict file source validation and consider blocking Office files from external sources temporarily; enhance endpoint detection and response (EDR) monitoring for Office process exploitation patterns; implement application sandboxing for Office documents from untrusted origins; maintain isolated, patched test environments for receiving external Office files before wider distribution.
Threat Intelligence Overview
NVD
CVE.org
CISA KEV
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Affected Products (CPE)CVE.org
Remote code execution in Microsoft Office 2007-2016 and Windows Vista through 10 allows attackers to execute arbitrary c
Microsoft Word Remote Code Execution Vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotely e
Microsoft SharePoint Server 2007 SP3, 2010 SP1 and SP2, and 2013; Office Web Apps 2010; Excel 2003 SP3, 2007 SP3, 2010 S
The font library in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows
Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Office for Mac 2011, Office fo
Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word Automation Services in SharePoint Server 2010, Web Applica
Buffer overflow in the Adobe Type Manager Library in Microsoft Windows Vista SP2, Windows Server 2008 SP2, Office 2007 S
Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, and Office for Mac 2011 allow remote attackers to execute arbit
Microsoft Office 2007 SP3 allows remote attackers to execute arbitrary code via a crafted document, aka "Microsoft Offic
Integer underflow in Microsoft Office 2007 SP3, Office 2010 SP2, Office 2013 SP1, Office 2013 RT SP1, Office for Mac 201
Microsoft Office 2007 SP3 and 2010 SP2, Live Meeting 2007 Console, Lync 2010, Lync 2010 Attendee, Lync 2013 SP1, and Lyn
Microsoft Excel Security Feature Bypass Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authenti
GitHub PoC
Exploit-DB