Description
Reliance on untrusted inputs in a security decision in Microsoft Office allows an unauthorized attacker to bypass a security feature locally.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Microsoft Microsoft 365 Apps for Enterprise
16.0.1 to < https://aka.ms/OfficeSecurityReleasesaffected
Microsoft Microsoft Office 2016
16.0.0 to < 16.0.5539.1001affected
Microsoft Microsoft Office 2019
19.0.0 to < 16.0.10417.20095affected
Microsoft Microsoft Office LTSC 2021
16.0.1 to < https://aka.ms/OfficeSecurityReleasesaffected
Microsoft Microsoft Office LTSC 2024
16.0.0 to < https://aka.ms/OfficeSecurityReleasesaffected
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21509 ↗
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-21509 ↗
- https://www.vicarius.io/vsociety/posts/cve-2026-21509-detection-script-microsoft-office-security-feature-bypass-vulnerability ↗
- https://www.vicarius.io/vsociety/posts/cve-2026-21509-mitigation-script-microsoft-office-security-feature-bypass-vulnerability ↗