In CISA KEV7.8 HighCWE-807
CVE-2026-21514
Microsoft Office Word Reliance on Untrusted Inputs in a Security Decision Vulnerability
MicrosoftOffice
Status
- Exploited in the wild
- In CISA KEV since 10 Feb
- Vendor fix available
Federal deadlineTue 3 Mar, 23:59 UTC
Passed 235 days ago
CISA KEV · added 10 Feb
Exploit probabilityEPSSchecked 25 Oct
1.6%probability of exploitation in the next 30 days
Higher than 75% of scored CVEs
SeverityCVSS
7.8High
Description NVD
Reliance on untrusted inputs in a security decision in Microsoft Office Word allows an unauthorized attacker to bypass a security feature locally.
CISA required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Coverage 9 articles · 8 outlets
See the full timelineShow as table
| Published (UTC) | Outlet | Headline |
|---|---|---|
| Tue 10 Feb · 19:40 UTC | SecurityWeek | 6 Actively Exploited Zero-Days Patched by Microsoft With February 2026 Updates |
| Tue 10 Feb · 21:55 UTC | Dark Reading | Microsoft Patches 6 Actively Exploited Zero-Days |
| Tue 10 Feb · 22:30 UTC | Krebs on Security | Patch Tuesday, February 2026 Edition |
| Tue 10 Feb · 23:35 UTC | Security Affairs | Microsoft Patch Tuesday security updates for February 2026 fix six actively exploited zero-days |
| Wed 11 Feb · 04:35 UTC | SecurityOnline | Patch Panic: Microsoft Fixes 6 Active Zero-Days in Feb 2026 Update |
| Wed 11 Feb · 08:25 UTC | Security Affairs | U.S. CISA adds Microsoft Office and Microsoft Windows flaws to its Known Exploited Vulnerabilities catalog |
| Wed 11 Feb · 12:40 UTC | Malwarebytes | February 2026 Patch Tuesday includes six actively exploited zero-days |
| Wed 11 Feb · 14:20 UTC | SOCRadar | February 2026 Patch Tuesday: Six Active Zero-Days & 53 Other Flaws Addressed |
| Thu 7 May · 10:11 UTC | Securelist | Office and Windows flaws boost exploit kits in Q1 2026 |
- Office and Windows flaws boost exploit kits in Q1 2026Securelist · mentions it in passing
- February 2026 Patch Tuesday: Six Active Zero-Days & 53 Other Flaws AddressedSOCRadar · mentions it in passing
- February 2026 Patch Tuesday includes six actively exploited zero-daysMalwarebytes · mentions it in passing
- U.S. CISA adds Microsoft Office and Microsoft Windows flaws to its Known Exploited Vulnerabilities catalogSecurity Affairs · mentions it in passing
- Patch Panic: Microsoft Fixes 6 Active Zero-Days in Feb 2026 UpdateSecurityOnline · mentions it in passing
- Microsoft Patch Tuesday security updates for February 2026 fix six actively exploited zero-daysSecurity Affairs · mentions it in passing
- Patch Tuesday, February 2026 EditionKrebs on Security · mentions it in passing
- Microsoft Patches 6 Actively Exploited Zero-DaysDark Reading · mentions it in passing
- 6 Actively Exploited Zero-Days Patched by Microsoft With February 2026 UpdatesSecurityWeek · first in our coverage · mentions it in passing