Skip to content

CVE-2026-21509

Security Feature Bypass in Microsoft Office. CISA confirmed attackers exploit it and added it to its Known Exploited Vulnerabilities catalog on 26 January 2026.

Product
Microsoft Office
Added to CISA's catalog
Federal fix-by date
Ransomware
No known use in ransomware campaigns
Vendor advisories
Sources
CISA’s catalog, NVD entry

CISA’s description.

Microsoft Office contains a security feature bypass vulnerability in which reliance on untrusted inputs in a security decision in Microsoft Office could allow an unauthorized attacker to bypass a security feature locally. Some of the impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version.

More from Microsoft this year.

Every flaw CISA confirmed exploited in the last 30 days is on the exploit watch. This is not security advice. Check the vendor’s advisory before acting. From CISA’s catalog of 3 November 2026.