CVE-2026-21509
Microsoft Office Security Feature Bypass Vulnerability
Description
CVE-2026-21509 is a high-severity security feature bypass vulnerability in Microsoft Office that stems from the application's reliance on untrusted inputs in security decisions. With a CVSS v3.1 base score of 7.8 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), the vulnerability allows an unauthorized attacker to bypass a security feature locally by convincing a user to open a specially crafted document. The flaw affects Microsoft 365 Apps, Microsoft Office 2016, 2019, and Office LTSC 2021 and 2024. It is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of February 16, 2026, and carries an EPSS score of 0.09208 (92.6th percentile), indicating significant real-world exploitation activity. CISA lists the ransomware association as "Unknown."
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | 365 apps | - |
| microsoft | office | 2016; 2019 |
| microsoft | office long term servicing channel | 2021; 2024 |
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21509(Vendor Advisory)
- https://www.vicarius.io/vsociety/posts/cve-2026-21509-detection-script-microsoft-office-security-feature-bypass-vulnerability(Third Party Advisory)
- https://www.vicarius.io/vsociety/posts/cve-2026-21509-mitigation-script-microsoft-office-security-feature-bypass-vulnerability(Mitigation, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-21509(US Government Resource)
Weakness Type
CWE-807: Reliance on Untrusted Inputs in a Security Decision
CVE-2026-21509 is classified under CWE-807, which describes software that uses input from an untrusted source in a protection mechanism that relies on the trustworthiness of that input. In the context of Microsoft Office, the application makes security decisions based on properties or metadata within document files that can be manipulated by an attacker. When a crafted document provides modified values that Office trusts without adequate validation, the application may skip security checks such as macro warnings, Protected View, or other safety mechanisms that would normally prevent execution of potentially harmful content. This allows the attacker to bypass security features designed to protect the user from malicious documents. Learn more about CWE-807
Impact Analysis
Security Feature Bypass Leading to Code Execution is the primary risk of CVE-2026-21509. While the vulnerability itself is a security feature bypass rather than direct code execution, bypassing Office's security mechanisms (such as Protected View, macro restrictions, or Mark of the Web enforcement) effectively removes the barriers that prevent document-based malware from executing. This makes it a critical enabler for follow-on attacks.
Confidentiality Impact is high (C:H). Once Office security features are bypassed, embedded macros, ActiveX controls, or other active content within a malicious document can execute with the full privileges of the user. This enables data exfiltration, credential harvesting, and access to any files and resources available to the compromised user account.
Integrity Impact is high (I:H). Malicious content executing without security restrictions can modify files, install malware, alter system configurations, and establish persistent backdoors. The bypass of security features means that the user receives no warning about the potentially dangerous content, making it far more likely that the attack succeeds without detection.
Availability Impact is high (A:H). Code execution through bypassed security features can lead to ransomware deployment, destructive malware, or other attacks that render the user's system or data unavailable.
User Interaction Required: The vulnerability requires the user to open a crafted document (UI:R), which is the typical delivery mechanism for Office-based attacks through phishing emails, shared documents, or malicious downloads. The EPSS score of 0.09208 (92.6th percentile) confirms that this attack vector is actively being exploited. CISA lists the ransomware association as "Unknown."
Exploit Maturity
CVE-2026-21509 is confirmed as actively exploited, as evidenced by its inclusion in CISA's KEV catalog with a remediation deadline of February 16, 2026. The EPSS score of 0.09208 (92.6th percentile) indicates that the vulnerability has a higher probability of exploitation than approximately 93% of all known vulnerabilities.
Active Exploitation in the Wild: Microsoft has acknowledged active exploitation through the MSRC advisory. Office security feature bypass vulnerabilities are highly valued by threat actors because they remove the security warnings and restrictions that normally prevent document-based malware from executing. When combined with malicious macros or embedded content, these bypasses enable silent code execution on victim systems.
Exploitation Context: Security feature bypass vulnerabilities in Microsoft Office are frequently used as the first stage in multi-step attack chains. The typical pattern involves delivering a crafted document via email or other channels, where the bypass ensures that Office does not display security warnings or activate Protected View. The document then executes embedded malicious content (macros, scripts, or exploits for other vulnerabilities) without the user being aware of the risk.
Ransomware Association: CISA lists the ransomware association as "Unknown." However, Office document-based attacks are one of the most common initial access vectors for ransomware operators, and security feature bypasses that facilitate silent execution are particularly attractive for these campaigns.
Mitigation Research: Vicarius has published detection and mitigation scripts for this vulnerability.
Remediation
-
Apply the Microsoft security update for CVE-2026-21509 immediately. The patch is available through Windows Update, Microsoft Update Catalog, and WSUS. Apply the update to all installations of Microsoft 365 Apps, Office 2016, Office 2019, and Office LTSC 2021 and 2024. Consult the MSRC advisory for specific KB article numbers and deployment guidance.
-
Enable Attack Surface Reduction (ASR) rules in Microsoft Defender for Endpoint as a defense-in-depth measure. Configure ASR rules to block Office applications from creating child processes, creating executable content, and injecting code into other processes. These rules mitigate the impact of security feature bypasses by restricting what malicious documents can do even if Office security features are circumvented.
-
Enforce Protected View and Application Guard policies through Group Policy or Intune. Ensure that documents from the internet, email attachments, and untrusted locations always open in Protected View. Microsoft Office Application Guard provides hardware-isolated container execution for untrusted documents, adding an additional security layer that is not affected by document-level security feature bypasses.
-
Disable macros for documents from the internet through Group Policy. Set the "Block macros from running in Office files from the internet" policy to Enabled. This prevents macro execution in documents that carry the Mark of the Web (MOTW), which is one of the security features that this vulnerability may bypass. Also consider setting the default macro setting to "Disable all macros without notification" for maximum protection.
-
Educate users about document-based phishing and reinforce that unexpected Office documents from unknown senders should not be opened. Implement email filtering rules that quarantine or flag messages with Office document attachments, particularly those containing macros. Deploy email security solutions that detonate suspicious attachments in sandboxed environments before delivery.
Technical Details
CVE-2026-21509 is a security feature bypass vulnerability in Microsoft Office caused by the application's reliance on untrusted inputs when making security decisions. The vulnerability affects Microsoft 365 Apps, Microsoft Office 2016, 2019, and Office LTSC 2021 and 2024.
CVSS Vector Breakdown: The vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H yields a score of 7.8. The attack vector is local (AV:L), meaning the attacker must deliver a file to the victim's system (typically through email or download). Attack complexity is low (AC:L), and no privileges are required (PR:N) on the part of the attacker. User interaction is required (UI:R) because the victim must open the crafted document. The scope is unchanged (S:U), and all impact dimensions are high (C:H/I:H/A:H) because the bypass enables execution of arbitrary code with user-level privileges.
Vulnerability Mechanism: Microsoft Office implements multiple layers of security features to protect users from malicious documents: Protected View (read-only sandbox), Mark of the Web (MOTW) enforcement, macro execution policies, and ActiveX/OLE restrictions. These security decisions are partially based on metadata, properties, or attributes within or associated with the document file. CVE-2026-21509 exploits the fact that Office trusts certain document-supplied values when making these security decisions. By crafting a document that manipulates these trusted inputs, an attacker can cause Office to skip or reduce security protections that would normally be applied.
Bypass Consequences: When the security features are bypassed, the document is treated as if it originated from a trusted source or safe location. This means macros can execute without user prompting, embedded objects can activate, and network connections can be established. The crafted document effectively receives the same trust level as a document created locally by the user, despite being delivered from an untrusted external source.
Attack Delivery: The vulnerability requires local file access (AV:L), which in practice means the attacker must deliver the crafted document to the victim through phishing emails, malicious websites, shared network drives, or other file transfer mechanisms. The user must then open the document, but the security feature bypass ensures they do not see the warnings that would normally alert them to the danger.
Frequently Asked Questions
What is CVE-2026-21509?
CVE-2026-21509 is a security feature bypass vulnerability in Microsoft Office that allows an attacker to circumvent built-in document security protections by manipulating inputs that Office trusts in security decisions. It has a CVSS score of 7.8 and requires the victim to open a crafted document. It affects Microsoft 365 Apps, Office 2016, 2019, and Office LTSC 2021 and 2024.
How is CVE-2026-21509 exploited?
An attacker creates a specially crafted Office document that manipulates metadata or properties that Office uses to make security decisions. When a user opens this document, Office incorrectly trusts the manipulated values and skips security protections like Protected View or macro restrictions. This allows embedded malicious content to execute without the user seeing any security warnings.
Which Microsoft Office versions are affected?
CVE-2026-21509 affects Microsoft 365 Apps (both enterprise and consumer), Microsoft Office 2016, Office 2019, Office LTSC 2021, and Office LTSC 2024. All platforms where these versions run are potentially affected. Apply the Microsoft security update specific to your installed Office version.
Does this vulnerability allow code execution on its own?
The vulnerability itself is a security feature bypass, not direct code execution. However, by disabling the security mechanisms that would normally block or warn about dangerous content, it enables embedded macros, ActiveX controls, or other active content to execute silently. In practice, this distinction is minimal because attackers chain the bypass with embedded malicious content in a single document.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.