CVE-2026-21509
Description
CVE-2026-21509 is a high-severity security bypass in Microsoft Office (CVSS 7.8) actively exploited in the wild. Update Office 2016-2024 and 365 Apps now.
CPE
| Product | Version Start | Version End (excl.) | Status |
|---|---|---|---|
| 365_apps | - | - | vulnerable |
| 365_apps | - | - | vulnerable |
| office | 2016 | 2016 | vulnerable |
| office | 2016 | 2016 | vulnerable |
| office | 2019 | 2019 | vulnerable |
| office | 2019 | 2019 | vulnerable |
| office_long_term_servicing_channel | 2021 | 2021 | vulnerable |
| office_long_term_servicing_channel | 2021 | 2021 | vulnerable |
| office_long_term_servicing_channel | 2024 | 2024 | vulnerable |
| office_long_term_servicing_channel | 2024 | 2024 | vulnerable |
Related weakness (CWE)
Remediation plan
Apply official patches
Visit the Microsoft Security Update Guide for CVE-2026-21509 to download and install the specific security updates for your version of Office.
Update affected systems
Ensure all installations of Microsoft Office 2016, 2019, 2021 LTSC, 2024 LTSC, and Microsoft 365 Apps are updated to the latest build versions provided by the vendor.
Restrict access
Implement the principle of least privilege (PoLP) to limit local user permissions and utilize Windows Defender Exploit Guard to reduce the attack surface for Office applications.
Monitor for exploitation
Use Endpoint Detection and Response (EDR) tools to monitor for unusual Office process behaviors, such as unexpected child process spawning or unauthorized modifications to security-related registry keys.
Detection Guidance
Detection should focus on identifying anomalous behavior within Microsoft Office processes. Monitor for Event ID 4688 (Process Creation) where Office applications like Word or Excel initiate suspicious command-line arguments or bypass standard security prompts. Additionally, audit logs for changes to Office security settings and look for indicators of CWE-807 exploitation, such as the manipulation of environment variables or configuration files used in security decision-making processes.