Security CISA KEV CVE-2026-21509 CVE-2026-21509 CISA KEV
Microsoft Office Security Feature Bypass Vulnerability
Severity unknown CVSS unknown Check the vendor advisory for fixed versions
CISA lists this Microsoft vulnerability as known exploited. Its MSRC release detail is outside this installation's collected history.
Microsoft Office contains a security feature bypass vulnerability in which reliance on untrusted inputs in a security decision in Microsoft Office could allow an unauthorized attacker to bypass a security feature locally. Some of the impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version.
Product Office
Added to KEV 26 Jan 2026
Federal remediation due 16 Feb 2026
Known ransomware use Not reported
Changes are dated when recorded; day views use the last saved version from that UTC day, and citations stay fixed.
Cite this version Field-level log (2)
Up to 100 recent field edits are shown; older edits may be outside retention.
23 Oct 2026 · 09:33:49 UTC
Source coverage: cisa-kev Incomplete → Current 23 Oct 2026 · 08:31:50 UTC
Source coverage: cisa-kev Current → Incomplete Explore global source statements, affected packages and advisory history for CVE-2026-21509 . The catalog has a separate collection scope from Microsoft release records.
More advisories, affected versions and source history
cve-program · CVE-2026-21509 Published Microsoft 365 Apps for Enterprise Vendor product
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Microsoft",
"product": "Microsoft 365 Apps for Enterprise",
"platforms": [
"32-bit Systems",
"x64-based Systems"
],
"versions": [
{
"version": "16.0.1",
"lessThan": "https://aka.ms/OfficeSecurityReleases",
"versionType": "custom",
"status": "affected"
}
]
} Microsoft Office 2016 Vendor product
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Microsoft",
"product": "Microsoft Office 2016",
"platforms": [
"32-bit Systems",
"x64-based Systems"
],
"versions": [
{
"version": "16.0.0",
"lessThan": "16.0.5539.1001",
"versionType": "custom",
"status": "affected"
}
]
} Microsoft Office 2019 Vendor product
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Microsoft",
"product": "Microsoft Office 2019",
"platforms": [
"32-bit Systems",
"x64-based Systems"
],
"versions": [
{
"version": "19.0.0",
"lessThan": "16.0.10417.20095",
"versionType": "custom",
"status": "affected"
}
]
} Microsoft Office LTSC 2021 Vendor product
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Microsoft",
"product": "Microsoft Office LTSC 2021",
"platforms": [
"32-bit Systems",
"x64-based Systems"
],
"versions": [
{
"version": "16.0.1",
"lessThan": "https://aka.ms/OfficeSecurityReleases",
"versionType": "custom",
"status": "affected"
}
]
} Microsoft Office LTSC 2024 Vendor product
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Microsoft",
"product": "Microsoft Office LTSC 2024",
"platforms": [
"32-bit Systems",
"x64-based Systems"
],
"versions": [
{
"version": "16.0.0",
"lessThan": "https://aka.ms/OfficeSecurityReleases",
"versionType": "custom",
"status": "affected"
}
]
} Original source record · Cite this exact observation · Complete original publisher JSON