CVE-2026-21509: Microsoft Office Security Feature Bypass Vulnerability

Microsoft Office contains a security feature bypass vulnerability that stems from reliance on untrusted inputs when making a security decision. An attacker with local access can circumvent a protection mechanism that the application should enforce.

How it works

The weakness is classified as CWE-807. The affected code path accepts input that should not be trusted for an access-control or integrity check and proceeds to act on that input. Because the decision occurs locally, an attacker who can supply or influence the input on the same system can cause the security feature to be skipped.

Am I affected? How to find it in your systems

Inventory all installations of Microsoft Office, including desktop applications and any integrated components that run on endpoints or servers. Confirm the exact versions and configurations against the vendor advisory, because some impacted releases may already be end-of-life or end-of-service. Review software-asset records, endpoint-management consoles, and configuration-management databases for any Office deployments that have not been updated to a supported branch.

• Examine local process execution and file-access logs for Office components that interact with user-supplied documents or macros; unexpected bypass behavior may appear as successful operations that policy should have blocked.
• Correlate endpoint telemetry for local privilege or feature-use anomalies that coincide with Office processes.

How to remediate

Apply the vendor-supplied update referenced in the advisory. Where a patch is unavailable because a product has reached end-of-life or end-of-service, discontinue use and migrate to a supported version. Follow any additional configuration guidance published by the vendor for the affected components.

If you can't patch immediately

Apply mitigations exactly as described in the vendor instructions. For cloud-hosted services, adhere to applicable BOD 22-01 requirements. Where mitigations cannot be implemented, remove or isolate the affected Office installations until they can be replaced or updated. Monitor for local attempts to invoke the bypassed security feature through existing endpoint-detection rules.

If your data may have been exposed

Actively exploited instances of this class of vulnerability have led to unauthorized access. Organizations can run a free exposure scan of their domains against known breach data to determine whether related credentials or documents have already appeared in public repositories.