Skip to content

CVE-2026-21514

Word Reliance on Untrusted Inputs in a Security Decision in Microsoft Office. CISA confirmed attackers exploit it and added it to its Known Exploited Vulnerabilities catalog on 10 February 2026.

Product
Microsoft Office
Added to CISA's catalog
Federal fix-by date
Ransomware
No known use in ransomware campaigns
Vendor advisories
Sources
CISA’s catalog, NVD entry

CISA’s description.

Microsoft Office Word contains a reliance on untrusted inputs in a security decision vulnerability that could allow an authorized attacker to elevate privileges locally.

More from Microsoft this year.

Every flaw CISA confirmed exploited in the last 30 days is on the exploit watch. This is not security advice. Check the vendor’s advisory before acting. From CISA’s catalog of 4 November 2026.