Vulnerability intelligence

CVE-2026-21509

Microsoft Office Security Feature Bypass Vulnerability

Reliance on untrusted inputs in a security decision in Microsoft Office allows an unauthorized attacker to bypass a security feature locally.

CVSS Score

7.8

High

EPSS — Exploit Probability

73%

Riskier than 99% of all CVEs · checked 2026-09-08

Exploitation

Confirmed in the wild

KEV since 2026-01-26

Remediation

Patch available

Federal deadline 2026-02-16

CISA required action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Deadline for federal agencies: 2026-02-16.

NVD entry Vendor patch PoC / advisory CISA KEV

21 articles across 10 outlets · first covered Apr 8, 2026 · latest May 7, 2026

Associated threat actors

APT28

Coverage timeline

Office and Windows flaws boost exploit kits in Q1 2026
securelist.com · May 7, 2026
Russia-linked APT28 uses PRISMEX to infiltrate Ukraine and allied infrastructure with advanced tactics
securityaffairs.com · Apr 8, 2026
APT28 Deploys New PRISMEX Malware Against Ukraine and NATO Allies
thehackernews.com · Apr 8, 2026
Pawn Storm Campaign Deploys PRISMEX, Targets Government and Critical Infrastructure Entities
www.trendmicro.com · Mar 26, 2026
MSHTML CVE-2026-21513 exploited by APT28; patch issued
thehackernews.com · Mar 2, 2026
APT28 Weaponizes Office Flaw to Spy on NATO & Military
securityonline.info · Feb 9, 2026
SECURITY AFFAIRS MALWARE NEWSLETTER ROUND 83
securityaffairs.com · Feb 8, 2026
Russian-state hackers exploit Office vulnerability to infect computers
arstechnica.com · Feb 4, 2026
Russian Hackers Weaponize Microsoft Office Bug in Just 3 Days
www.darkreading.com · Feb 3, 2026
APT28 exploits Microsoft Office flaw in Operation Neusploit
securityaffairs.com · Feb 3, 2026
CVE-2026-21509: APT28 Actively Exploits Microsoft Office Vulnerability in Ukraine
socradar.io · Feb 3, 2026
Russia’s APT28 Rapidly Weaponizes Newly Patched Office Vulnerability
www.securityweek.com · Feb 3, 2026
APT28 Uses Microsoft Office CVE-2026-21509 in Espionage-Focused Malware Attacks
thehackernews.com · Feb 3, 2026
Fancy Bear Returns: APT28 Exploits Office Flaw in “Operation Neusploit”
securityonline.info · Feb 3, 2026
Microsoft Office zero-day lets malicious documents slip past security checks
www.malwarebytes.com · Jan 29, 2026
Microsoft Rushes Emergency Patch for Office Zero-Day
www.darkreading.com · Jan 27, 2026
U.S. CISA adds Microsoft Office, GNU InetUtils, SmarterTools SmarterMail, and Linux Kernel flaws to its Known Exploited Vulnerabilities catalog
securityaffairs.com · Jan 27, 2026
Microsoft Patches Office Zero-Day Likely Exploited in Targeted Attacks
www.securityweek.com · Jan 27, 2026
Microsoft Office Zero-Day (CVE-2026-21509) - Emergency Patch Issued for Active Exploitation
thehackernews.com · Jan 27, 2026
Under Attack: Microsoft Patches Office Zero-Day (CVE-2026-21509) Exploited in the Wild
securityonline.info · Jan 27, 2026
Emergency Microsoft update fixes in-the-wild Office zero-day
securityaffairs.com · Jan 26, 2026

Related CVEs — Microsoft

CVE-2026-69414 CVE-2026-85880KEV CVE-2026-81963KEV CVE-2026-55007 CVE-2026-69380 CVE-2026-69730 CVE-2026-69525 CVE-2026-69829