Microsoft Office Zero-Day (CVE-2026-21509) - Emergency Patch Issued for Active Exploitation
Summary: Microsoft issued out-of-band patches on Monday for CVE-2026-21509, a high-severity Office security feature bypass with a CVSS score of 7.8 that bypasses OLE mitigations protecting users from vulnerable COM/OLE controls. Exploitation requires an attacker to send a crafted Office file and convince a recipient to open it, and CISA has added the flaw to its KEV catalog with a February 16, 2026 patch deadline for FCEB agencies.
Bottom line: Office 2021 and later customers are covered only by a service-side change that takes effect after they restart their Office applications, while Office 2016 and 2019 users must install updates and apply a registry mitigation - and Microsoft has disclosed nothing about the nature or scope of the attacks already exploiting it.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2026-21509
- Related
- CVE-2026-21509: Microsoft Office Security Feature Bypass Vulnerability Known Exploited Vulnerabilities · Jan 26, 2026