Vulnerability intelligence
CVE-2026-21514
Microsoft Office Word Reliance on Untrusted Inputs in a Security Decision Vulnerability
Reliance on untrusted inputs in a security decision in Microsoft Office Word allows an unauthorized attacker to bypass a security feature locally.
CVSS Score
7.8
High
EPSS — Exploit Probability
5.4%
Riskier than 90% of all CVEs
Exploitation
Confirmed in the wild
Used in ransomware campaigns
Remediation
Patch available
Federal deadline 2026-03-03
CISA required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Deadline for federal agencies: 2026-03-03.
1 article across 1 outlet · first covered May 7, 2026 · latest May 7, 2026
Coverage timeline
-
Office and Windows flaws boost exploit kits in Q1 2026securelist.com · May 7, 2026