Microsoft Issues Emergency Patch for Office Zero-Day Vulnerability CVE-2026-21509
- Securityish
- Threats & Incidents
Quick Summary
Microsoft has released an emergency patch for a zero-day vulnerability, tracked as CVE-2026-21509, affecting most current Office builds. This flaw, with a CVSS score of 7.8, allows attackers to bypass security features designed to prevent unsafe legacy components from running. Exploitation requires convincing a user to open a malicious Office file, impacting users of Office 2016, 2019, and Microsoft 365 Apps for Enterprise, with fixes for older versions still pending.
The Securityish Brief
Microsoft has confirmed that a zero-day vulnerability, designated CVE-2026-21509, is actively being exploited in the wild. The flaw is categorized as a security feature bypass, allowing unauthorized attackers to circumvent protections meant to prevent unsafe legacy components, such as COM and OLE, from executing. This vulnerability affects various Office builds, including Office 2016, 2019, and Microsoft 365 Apps for Enterprise, with a CVSS score of 7.8 indicating a significant risk.
Exploitation of this flaw does not depend on the Office preview pane, a common vector in previous attacks, but rather requires minimal effort once a victim is tricked into opening a compromised file. Microsoft describes the issue as stemming from a reliance on untrusted inputs in security decisions, meaning that Office can be manipulated into executing unsafe actions.
Currently, users of Office 2016 and 2019 are awaiting fixes, as Microsoft has not yet released updates for these versions. In the meantime, Microsoft has recommended mitigation steps that involve manually blocking vulnerable COM and OLE controls through registry modifications, a process that may be challenging for many organizations to implement effectively.
The US Cybersecurity and Infrastructure Security Agency (CISA) has added this vulnerability to its Known Exploited Vulnerabilities catalog, mandating that Federal Civilian Executive Branch agencies apply available fixes by February 16. This quick response highlights the urgency of addressing this security issue.
This incident follows closely on the heels of another vulnerability, CVE-2026-20805, which Microsoft had previously warned about, indicating a troubling trend of vulnerabilities being exploited in 2026.
Key Takeaways
- Update your Microsoft Office applications to the latest version to protect against known vulnerabilities.
- Educate users about the risks of opening unsolicited Office files to reduce the likelihood of exploitation.
- Implement the recommended registry changes to block vulnerable COM and OLE controls as a temporary measure.
- Monitor communications from Microsoft for updates regarding patches for Office 2016 and 2019.
- Check your organization’s compliance with CISA’s recommendations regarding the application of security patches.
Key Terms & Concepts
- CVE-2026-21509: In this article, CVE-2026-21509 refers to a zero-day vulnerability in Microsoft Office that allows attackers to bypass security features.
- COM: COM stands for Component Object Model, a Microsoft technology that allows different software components to communicate.
- OLE: OLE, or Object Linking and Embedding, is a technology that allows embedding and linking to documents and other objects.
- CVSS: CVSS, or Common Vulnerability Scoring System, is a standard for assessing the severity of security vulnerabilities.
Read the original article here: https://go.theregister.com/feed/www.theregister.com/2026/01/27/office_zeroday_exploited_in_the/
Your 5-Minute Securityish Brief
A weekly digest of cybersecurity news, phishing alerts, privacy tips, and emerging threats, simplified so anyone can understand what matters and why.
Securityish
Securityish explains cybersecurity, scams, data breaches, and privacy risks in simple language so you know what’s happening and how to protect yourself.
© 2026 Securityish
