365 Apps
CVE-2026-21514
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious Office Word document
-
ExploitUser opens document locally
-
ExecutionUntrusted input bypasses security decision
-
ImpactExecute arbitrary code with user privileges
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Trusted input validation
|
| Exploitation Conditions | Local access to target system with Microsoft Office Word installed. User interaction required: victim must open attacker-crafted Word document. No authentication needed. Exploits reliance on untrusted inputs in security feature validation. |
| Impact | CVSS 7.8 (High). KEV-listed — actively exploited in targeted campaigns. EPSS 4.5%. Requires user to open document. Bypasses fundamental document security. Common vector for APT phishing campaigns. |
| Exploit ScenarioDerived | An attacker crafts a malicious Word document with manipulated metadata that bypasses Protected View. The document is sent via targeted phishing email. When the victim opens it, the document opens directly in editing mode (not Protected View), allowing embedded malicious macros or exploits to execute immediately without additional user prompts. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
Microsoft Office Word contains a security decision bypass (CVE-2026-21514, CVSS 7.8) through reliance on untrusted inputs, allowing local attackers to bypass protections when opening malicious documents. KEV-listed, this vulnerability enables document-based attacks that circumvent Word's security features designed to protect users from malicious content.
Earlier versions of this analysis (1)
Microsoft Word relies on untrusted inputs (CWE-807) in security decisions, allowing attackers to craft documents that bypass security features like Protected View and macro restrictions.
RemediationAI
Apply Microsoft security update. Block macros from internet-sourced documents via Group Policy. Enable ASR rules for Office applications. Implement email attachment sandboxing.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 5 packages in microsoft
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Word uses file metadata, Zone.Identifier, and other attributes to determine whether security restrictions should apply to a document. By manipulating these inputs, an attacker can cause Word to treat a malicious document as trusted, bypassing Protected View and other protective mechanisms. This is a security feature bypass that enables exploitation of other vulnerabilities or direct macro execution.
Know when 365 Apps gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
Reliance on untrusted inputs in a security decision in Microsoft Office Word allows an unauthorized attacker to bypass a security feature locally.
Executive ViewAI
A high-severity vulnerability in Microsoft Office Word is being actively exploited in the wild to bypass security features and gain unauthorized local access. This affects all organizations using Word and requires immediate mitigation as no patch is currently available from Microsoft.
Disable or restrict macro execution in Word through Group Policy Objects (GPO) or Microsoft 365 security settings; implement email gateway controls to block executable attachments and suspicious Office files; enforce application whitelisting to limit Word process capabilities; require users to open untrusted documents in Protected View with macro blocking enabled; segment network to limit lateral movement if local bypass occurs; monitor process execution logs for suspicious Word behavior (child processes, registry modifications, file system writes to sensitive locations).
Threat Intelligence Overview
NVD
CVE.org
CISA KEV
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Affected Products (CPE)CVE.org
Microsoft Outlook Remote Code Execution Vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotel
Microsoft Excel Security Feature Bypass Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authenti
Microsoft Outlook Security Feature Bypass Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely
Microsoft Publisher Security Feature Bypass Vulnerability. Rated high severity (CVSS 7.3), this vulnerability is low att
Microsoft Office contains a security feature bypass (CVE-2026-21509, CVSS 7.8) where reliance on untrusted inputs in sec
Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vu
Microsoft Office Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentic
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentica
Use-after-free vulnerability in Microsoft Office Word that allows local, unauthenticated attackers to execute arbitrary
Microsoft Excel Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely expl
Microsoft Office Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack
A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle obje
GitHub PoC
Exploit-DB