CVE-2026-21509: Technical Deep-Dive (Auto Refreshed)

Generated on 2026-03-23T21:45:41.734Z. This file is automatically regenerated every 30 minutes by the CVE AI enrichment job using web sources (NVD, MITRE, CISA KEV, GitHub).

Executive Technical Summary

Reliance on untrusted inputs in a security decision in Microsoft Office allows an unauthorized attacker to bypass a security feature locally.

• Context preserved from previous revision: Microsoft Office contains a security feature bypass vulnerability in which reliance on untrusted inputs in a security decision in Microsoft Office could allow an unauthorized attacker to bypass a security feature locally. Some of the impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version. 1. Use only isolated environments and systems you own or are explicitly authorized to test.

Technical Details

• CVE: CVE-2026-21509
• KEV date added: 2026-01-26
• KEV due date: 2026-02-16
• NVD published: 2026-01-26
• NVD modified: 2026-02-11
• MITRE modified: 2026-02-22
• CVSS base score: 7.8
• CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
• CVSS exploitability score: 1.8
• CVSS impact score: 5.9
• Attack vector: Local
• Attack complexity: Low
• Privileges required: None
• User interaction: Required
• Scope: Unchanged
• Confidentiality impact: High
• Integrity impact: High
• Availability impact: High

Versions and Products Impacted

• microsoft / 365 apps
• microsoft / office (versions: 2016)
• microsoft / office (versions: 2019)
• microsoft / office long term servicing channel (versions: 2021)
• microsoft / office long term servicing channel (versions: 2024)
• Microsoft / Microsoft 365 Apps for Enterprise (versions: 16.0.1)
• Microsoft / Microsoft Office 2016 (versions: 16.0.0)
• Microsoft / Microsoft Office 2019 (versions: 19.0.0)
• Microsoft / Microsoft Office LTSC 2021 (versions: 16.0.1)
• Microsoft / Microsoft Office LTSC 2024 (versions: 16.0.0)

Weakness Classification

• CWE-807

Repositories for Lab Validation (Public Examples)

• nomi-sec/PoC-in-GitHub | stars: 7594 | updated: 2026-03-23 | https://github.com/nomi-sec/PoC-in-GitHub
  Notes: 📡 PoC auto collect from GitHub. ⚠️ Be careful Malware.
• 0xMarcio/cve | stars: 1177 | updated: 2026-03-23 | https://github.com/0xMarcio/cve
  Notes: Latest CVEs with their Proof of Concept exploits.
• DarkFunct/TK-CVE-Repo | stars: 43 | updated: 2026-03-23 | https://github.com/DarkFunct/TK-CVE-Repo
  Notes: TK-CVE-Repo

People and Organizations Mentioned

• microsoft
• Office
• nomi-sec
• 0xMarcio
• DarkFunct

Practical Defensive Validation (Authorized Only)

1. Use only isolated environments and systems you own or are explicitly authorized to test.
2. Snapshot infrastructure before validation and preserve baseline logs (EDR, SIEM, OS, app).
3. Inventory microsoft / 365 apps assets and confirm exact vulnerable versions with automated checks.
4. Patch in staged environments and validate closure with scanners + service health checks.
5. Map detections to MITRE ATT&CK tactics relevant to your environment and tune alert quality.

References

• NVD record: https://nvd.nist.gov/vuln/detail/CVE-2026-21509
• MITRE CVE record: https://www.cve.org/CVERecord?id=CVE-2026-21509
• CISA KEV Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• CISA KEV JSON feed: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
• KEV notes: Please adhere to Microsoft’s recommended guidelines to address this vulnerability. Implement all final mitigations provided by the vendor for Office 2021, and apply the interim corresponding mitigations for Office 2016 and Office 2019 until the final patch becomes available. For more information please see: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21509 ; https://nvd.nist.gov/vuln/detail/CVE-2026-21509
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21509
• https://www.vicarius.io/vsociety/posts/cve-2026-21509-detection-script-microsoft-office-security-feature-bypass-vulnerability
• https://www.vicarius.io/vsociety/posts/cve-2026-21509-mitigation-script-microsoft-office-security-feature-bypass-vulnerability
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-21509
• Repository example: https://github.com/nomi-sec/PoC-in-GitHub
• Repository example: https://github.com/0xMarcio/cve
• Repository example: https://github.com/DarkFunct/TK-CVE-Repo

This content is for defensive security training and authorized validation only.