CVE-2026-21514: Technical Deep-Dive (Auto Refreshed)

Generated on 2026-03-23T21:45:43.333Z. This file is automatically regenerated every 30 minutes by the CVE AI enrichment job using web sources (NVD, MITRE, CISA KEV, GitHub).

Executive Technical Summary

Reliance on untrusted inputs in a security decision in Microsoft Office Word allows an unauthorized attacker to bypass a security feature locally.

• Context preserved from previous revision: Reliance on untrusted inputs in a security decision in Microsoft Office Word allows an unauthorized attacker to bypass a security feature locally. Notes: Cerberus-CVE Assessment Situation

Technical Details

• CVE: CVE-2026-21514
• KEV date added: 2026-02-10
• KEV due date: 2026-03-03
• NVD published: 2026-02-10
• NVD modified: 2026-02-11
• MITRE modified: 2026-03-16
• CVSS base score: 7.8
• CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
• CVSS exploitability score: 1.8
• CVSS impact score: 5.9
• Attack vector: Local
• Attack complexity: Low
• Privileges required: None
• User interaction: Required
• Scope: Unchanged
• Confidentiality impact: High
• Integrity impact: High
• Availability impact: High

Versions and Products Impacted

• microsoft / 365 apps
• microsoft / office long term servicing channel (versions: 2021)
• microsoft / office long term servicing channel (versions: 2024)
• Microsoft / Microsoft 365 Apps for Enterprise (versions: 16.0.1)
• Microsoft / Microsoft Office LTSC 2021 (versions: 16.0.1)
• Microsoft / Microsoft Office LTSC 2024 (versions: 16.0.0)
• Microsoft / Microsoft Office LTSC for Mac 2021 (versions: 16.0.1)
• Microsoft / Microsoft Office LTSC for Mac 2024 (versions: 16.0.0)

Weakness Classification

• CWE-807

Repositories for Lab Validation (Public Examples)

• ekomsSavior/Cerberus | stars: 15 | updated: 2026-03-13 | https://github.com/ekomsSavior/Cerberus
  Notes: Cerberus-CVE Assessment Situation
• greenido/CISA-alerts-bot | stars: 0 | updated: 2026-02-13 | https://github.com/greenido/CISA-alerts-bot
  Notes: A stateless GitHub Action that monitors Cybersecurity Alerts and sends structured alerts to Slack / Telegram

People and Organizations Mentioned

• microsoft
• Office
• ekomsSavior
• greenido

Practical Defensive Validation (Authorized Only)

1. Use only isolated environments and systems you own or are explicitly authorized to test.
2. Snapshot infrastructure before validation and preserve baseline logs (EDR, SIEM, OS, app).
3. Inventory microsoft / 365 apps assets and confirm exact vulnerable versions with automated checks.
4. Patch in staged environments and validate closure with scanners + service health checks.
5. Map detections to MITRE ATT&CK tactics relevant to your environment and tune alert quality.

References

• NVD record: https://nvd.nist.gov/vuln/detail/CVE-2026-21514
• MITRE CVE record: https://www.cve.org/CVERecord?id=CVE-2026-21514
• CISA KEV Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• CISA KEV JSON feed: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
• KEV notes: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21514 ; https://nvd.nist.gov/vuln/detail/CVE-2026-21514
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21514
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-21514
• Repository example: https://github.com/ekomsSavior/Cerberus
• Repository example: https://github.com/greenido/CISA-alerts-bot

This content is for defensive security training and authorized validation only.