Vulnerability Details CVE-2026-21509
Reliance on untrusted inputs in a security decision in Microsoft Office allows an unauthorized attacker to bypass a security feature locally.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.093
EPSS Ranking 92.6%
CVSS Severity
CVSS v3 Score 7.8
Proposed Action
Microsoft Office contains a security feature bypass vulnerability in which reliance on untrusted inputs in a security decision in Microsoft Office could allow an unauthorized attacker to bypass a security feature locally. Some of the impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version.
Ransomware Campaign
Unknown
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21509
- https://www.vicarius.io/vsociety/posts/cve-2026-21509-detection-script-microsoft-office-security-feature-bypass-vulnerability
- https://www.vicarius.io/vsociety/posts/cve-2026-21509-mitigation-script-microsoft-office-security-feature-bypass-vulnerability
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-21509
Products affected by CVE-2026-21509
-
cpe:2.3:a:microsoft:365_apps:-
-
cpe:2.3:a:microsoft:office:2016
-
cpe:2.3:a:microsoft:office:2019
-
cpe:2.3:a:microsoft:office_long_term_servicing_channel:2021
-
cpe:2.3:a:microsoft:office_long_term_servicing_channel:2024