CVE-2026-21514
Microsoft Office Word Reliance on Untrusted Inputs in a Security Decision Vulnerability
Description
CVE-2026-21514 is a high-severity security feature bypass vulnerability in Microsoft Office Word caused by reliance on untrusted inputs in a security decision. With a CVSS v3.1 base score of 7.8, the flaw allows an unauthenticated attacker to bypass Word's security protections when a user opens a specially crafted document. CISA has added this vulnerability to the Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of March 3, 2026, and the ransomware association is currently classified as unknown. The EPSS score of 2.15% at the 84.0th percentile places this vulnerability in the upper tier of exploitation probability, confirming active targeting of Office environments in the wild. Microsoft 365 Apps and Office LTSC 2021 and 2024 editions are affected.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | 365 apps | - |
| microsoft | office long term servicing channel | 2021; 2024 |
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21514(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-21514(US Government Resource)
Weakness Type
CWE-807: Reliance on Untrusted Inputs in a Security Decision
CVE-2026-21514 is classified under CWE-807 (Reliance on Untrusted Inputs in a Security Decision). This weakness occurs when software makes security-relevant decisions based on input values that can be controlled or influenced by an attacker, without independent verification of their authenticity or integrity. In the context of Microsoft Word, the application relies on document metadata or embedded indicators to determine whether certain security restrictions should be applied. An attacker can manipulate these inputs within a crafted document to convince Word that the content is trusted or that security features should not be enforced, effectively bypassing protections such as Protected View, macro restrictions, or content warning dialogs. This class of vulnerability is particularly insidious because it undermines the security mechanisms that users and organizations depend on to prevent malicious document exploitation. Learn more about CWE-807
Impact Analysis
The impact of CVE-2026-21514 is severe across all three dimensions of the CIA triad. Confidentiality is fully compromised because bypassing Word's security features enables the execution of embedded content that can exfiltrate sensitive data from the victim's system, including documents, credentials, email content, and network information. When Protected View or similar restrictions are bypassed, macros and active content execute without the user receiving expected security warnings, giving the attacker silent access to the user's files and environment.
Integrity faces maximum impact as the security bypass enables the attacker to execute arbitrary code within the user's security context. This can include installing backdoors, modifying system configurations, tampering with files, and establishing persistent access. The attack effectively turns a document that the user might reasonably expect to be safe into a vehicle for full system compromise.
Availability is critically affected because the code execution achieved through the security bypass can be used to deploy destructive payloads, encrypt files with ransomware, or disrupt system operations. The CVSS vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H confirms that while user interaction is required (the victim must open the document), no privileges are needed by the attacker to craft the exploit, and the attack complexity is low. The combination of a KEV listing and an 84th percentile EPSS score indicates that threat actors are actively weaponizing this vulnerability in phishing campaigns targeting organizations that use Microsoft 365 and Office LTSC products.
Exploit Maturity
CVE-2026-21514 has confirmed active exploitation as evidenced by its inclusion in CISA's Known Exploited Vulnerabilities catalog with a remediation deadline of March 3, 2026. The EPSS score of 2.15% at the 84.0th percentile reflects exploitation activity that exceeds approximately 84% of all tracked vulnerabilities. The official Microsoft advisory is available at CVE-2026-21514, and the CISA KEV entry can be reviewed at the KEV catalog.
Security feature bypass vulnerabilities in Microsoft Office are among the most valuable capabilities in the attacker arsenal because they eliminate the human-visible security prompts that organizations rely on as a last line of defense against malicious documents. When Word's security decision logic is subverted, carefully crafted documents can execute embedded macros, ActiveX controls, or linked content without triggering Protected View, trust bar warnings, or macro block notifications. This makes phishing campaigns significantly more effective because the victim sees no indication that the document behaves differently from a legitimate file. The ransomware association is classified as unknown, but Office security bypasses are routinely chained with macro-based loaders that deploy ransomware and information stealers.
Remediation
-
Apply the Microsoft security update immediately for all affected Office products. The vulnerability affects Microsoft 365 Apps for Enterprise and Office Long Term Servicing Channel editions 2021 and 2024. Consult the Microsoft Security Response Center advisory for specific update channels and version numbers. Given the KEV listing, patching should be treated as an emergency priority.
-
Enable Attack Surface Reduction (ASR) rules in Microsoft Defender for Endpoint as a compensating control while patches are deployed. Specifically, enable rules that block Office applications from creating child processes, block Office applications from injecting code into other processes, and block Win32 API calls from Office macros. These rules provide defense-in-depth against exploitation even if the security bypass is triggered.
-
Enforce macro policies through Group Policy or Intune to disable macros from the internet in all Office applications. Configure the "Block macros from running in Office files from the Internet" policy and ensure that only digitally signed macros from trusted publishers are allowed to execute. These policies add an additional layer of protection that is independent of the bypassed security decision.
-
Educate users about document-based threats and reinforce the importance of not opening unexpected attachments, even from seemingly trusted senders. Implement email gateway rules that strip or quarantine Office documents with embedded macros, and consider converting incoming Office attachments to PDF format at the email gateway to neutralize active content.
-
Monitor for exploitation indicators by reviewing endpoint detection logs for suspicious Office process behavior, including Word spawning child processes such as PowerShell, cmd.exe, or mshta.exe. Alert on documents that execute active content without triggering expected Protected View events, as this pattern may indicate successful exploitation of the security bypass.
Technical Details
CVE-2026-21514 is a security feature bypass vulnerability in Microsoft Office Word, characterized by the CVSS v3.1 vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. Breaking down the vector: Attack Vector (AV:L) indicates local exploitation, meaning the attacker delivers a malicious document that the victim opens on their local system. Attack Complexity (AC:L) confirms that no special conditions are needed beyond delivering the crafted document. Privileges Required (PR:N) means the attacker needs no authentication or prior access to the target system. User Interaction (UI:R) requires the victim to open the malicious document, which is the standard delivery mechanism for Office-based attacks. Scope (S:U) keeps the impact within the Word process security context, though this context typically has full access to the user's files and can spawn additional processes.
The vulnerability stems from Word's reliance on document-embedded indicators to make security enforcement decisions. Microsoft Office implements multiple layers of trust evaluation when opening documents, including checking the file's origin zone (Mark of the Web), evaluating document properties and metadata, and determining whether security restrictions such as Protected View should be applied. CVE-2026-21514 allows an attacker to craft a document that manipulates the inputs to these trust decisions, causing Word to treat the document as trusted when it should be restricted. This bypass effectively neutralizes Protected View, macro warnings, and other security barriers that normally prevent malicious content from executing automatically. The affected products include Microsoft 365 Apps (current channel) and Office LTSC editions 2021 and 2024, which share the same Word codebase and are therefore all vulnerable to the same document manipulation technique.
Frequently Asked Questions
What is CVE-2026-21514?
CVE-2026-21514 is a high-severity security feature bypass vulnerability in Microsoft Office Word that allows an attacker to craft a document that circumvents Word's built-in security protections. It carries a CVSS score of 7.8 and is listed in CISA's KEV catalog with active exploitation confirmed.
How is CVE-2026-21514 exploited?
An attacker creates a specially crafted Word document that manipulates the inputs Word uses to make security decisions, such as whether to enable Protected View or block macros. When a victim opens the document, these protections are bypassed, allowing embedded malicious content to execute without the expected security warnings.
Which Microsoft Office products are affected?
Microsoft 365 Apps for Enterprise and Office Long Term Servicing Channel editions 2021 and 2024 are affected. Organizations should apply the latest security updates for all Office installations immediately.
Does opening the document automatically compromise my system?
The vulnerability requires user interaction to open the malicious document, but once opened, the security bypass can enable automatic execution of malicious content without additional user prompts. This makes it more dangerous than typical document attacks where the user would see and potentially dismiss a security warning.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.