CVE-2026-21509

No fix known ExploitedEPSS 71%CVSS 7.8

Reliance on untrusted inputs in a security decision in Microsoft Office allows an unauthorized attacker to bypass a security feature locally.

Published 2026-01-26 · In CISA KEV since 2026-01-26 · CVE record · OSV

Products: Microsoft 365 Apps for Enterprise, Microsoft Office 2016, Microsoft Office 2019, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024