Vulnerability intelligence
CVE-2026-21514
Microsoft Office Word Reliance on Untrusted Inputs in a Security Decision Vulnerability
Reliance on untrusted inputs in a security decision in Microsoft Office Word allows an unauthorized attacker to bypass a security feature locally.
CVSS Score
7.8
High
EPSS — Exploit Probability
1.5%
Riskier than 73% of all CVEs · checked 2026-09-07
Exploitation
Confirmed in the wild
KEV since 2026-02-10
Remediation
Patch available
Federal deadline 2026-03-03
CISA required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Deadline for federal agencies: 2026-03-03.
9 articles across 8 outlets · first covered May 7, 2026 · latest May 7, 2026
Coverage timeline
-
Office and Windows flaws boost exploit kits in Q1 2026securelist.com · May 7, 2026
-
February 2026 Patch Tuesday: Six Active Zero-Days & 53 Other Flaws Addressedsocradar.io · Feb 11, 2026
-
February 2026 Patch Tuesday includes six actively exploited zero-dayswww.malwarebytes.com · Feb 11, 2026
-
U.S. CISA adds Microsoft Office and Microsoft Windows flaws to its Known Exploited Vulnerabilities catalogsecurityaffairs.com · Feb 11, 2026
-
Patch Panic: Microsoft Fixes 6 Active Zero-Days in Feb 2026 Updatesecurityonline.info · Feb 11, 2026
-
Microsoft Patch Tuesday security updates for February 2026 fix six actively exploited zero-dayssecurityaffairs.com · Feb 10, 2026
-
Patch Tuesday, February 2026 Editionkrebsonsecurity.com · Feb 10, 2026
-
Microsoft Patches 6 Actively Exploited Zero-Dayswww.darkreading.com · Feb 10, 2026
-
6 Actively Exploited Zero-Days Patched by Microsoft With February 2026 Updateswww.securityweek.com · Feb 10, 2026