CVE-2026-21509
Microsoft Office Security Feature Bypass Vulnerability
Microsoft OfficeApplications & CMS
CVSS
7.8HighExploit odds (EPSS)70.8%Chance of exploitation activity in the next 30 days, higher than 99% of CVEs. Scored 23 Oct 2026FIRST EPSS
CISA required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. CISA KEV
What fixes it
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Timeline
Description
Microsoft Office contains a security feature bypass vulnerability in which reliance on untrusted inputs in a security decision in Microsoft Office could allow an unauthorized attacker to bypass a security feature locally. Some of the impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version.
Text from CVE List
Affected versions 5
- Microsoft 365 Apps for Enterpriseaffected: 16.0.1 before https://aka.ms/OfficeSecurityReleasesCVE List
- Microsoft Office 2016affected: 16.0.0 before 16.0.5539.1001CVE List
- Microsoft Office 2019affected: 19.0.0 before 16.0.10417.20095CVE List
- Microsoft Office LTSC 2021affected: 16.0.1 before https://aka.ms/OfficeSecurityReleasesCVE List
- Microsoft Office LTSC 2024affected: 16.0.0 before https://aka.ms/OfficeSecurityReleasesCVE List
References 5
- msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21509Fixvia CVE List
- vicarius.io/vsociety/posts/cve-2026-21509-detection-script-microsoft-office-security-feature-bypass-vulnerabilityAdvisoryvia CVE List
- vicarius.io/vsociety/posts/cve-2026-21509-mitigation-script-microsoft-office-security-feature-bypass-vulnerabilityAdvisoryvia CVE List
- nvd.nist.gov/vuln/detail/CVE-2026-21509Referencevia CISA KEV
- cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-21509Referencevia CVE List