Baitaphish
Security intelligence
SearchLatest briefing
CVE Explorer

CVE-2026-21509

Reliance on untrusted inputs in a security decision in Microsoft Office allows an unauthorized attacker to bypass a security feature locally.
Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:6cae38a085c700edf979658ad1aa5912c2c41107ab751929e6326e7512ae016c
Known exploited
CISA KEV
Disputed
No
Stale source
No
Conflicts
1

Preserved source conflicts

No provider value was silently selected as the winner.

affected · 5 assertions

{"platforms":["32-bit Systems","x64-based Systems"],"product":"Microsoft Office LTSC 2024","vendor":"Microsoft","versions":[{"lessThan":"https://aka.ms/OfficeSecurityReleases","status":"affected","version":"16.0.0","versionType":"custom"}]}

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:f97b91f32f1e68c31be726cb2f0d9c7645e2973bff0c5fab64f76db8fb7dc34b · sha256:2a09fd35bec50b8a… · /containers/cna/affected/4

{"platforms":["32-bit Systems","x64-based Systems"],"product":"Microsoft Office 2016","vendor":"Microsoft","versions":[{"lessThan":"16.0.5539.1001","status":"affected","version":"16.0.0","versionType":"custom"}]}

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:f97b91f32f1e68c31be726cb2f0d9c7645e2973bff0c5fab64f76db8fb7dc34b · sha256:2a09fd35bec50b8a… · /containers/cna/affected/1

{"platforms":["32-bit Systems","x64-based Systems"],"product":"Microsoft 365 Apps for Enterprise","vendor":"Microsoft","versions":[{"lessThan":"https://aka.ms/OfficeSecurityReleases","status":"affected","version":"16.0.1","versionType":"custom"}]}

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:f97b91f32f1e68c31be726cb2f0d9c7645e2973bff0c5fab64f76db8fb7dc34b · sha256:2a09fd35bec50b8a… · /containers/cna/affected/0

{"platforms":["32-bit Systems","x64-based Systems"],"product":"Microsoft Office LTSC 2021","vendor":"Microsoft","versions":[{"lessThan":"https://aka.ms/OfficeSecurityReleases","status":"affected","version":"16.0.1","versionType":"custom"}]}

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:f97b91f32f1e68c31be726cb2f0d9c7645e2973bff0c5fab64f76db8fb7dc34b · sha256:2a09fd35bec50b8a… · /containers/cna/affected/3

{"platforms":["32-bit Systems","x64-based Systems"],"product":"Microsoft Office 2019","vendor":"Microsoft","versions":[{"lessThan":"16.0.10417.20095","status":"affected","version":"19.0.0","versionType":"custom"}]}

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:f97b91f32f1e68c31be726cb2f0d9c7645e2973bff0c5fab64f76db8fb7dc34b · sha256:2a09fd35bec50b8a… · /containers/cna/affected/2

Affected products and versions

5 source assertions
{"platforms":["32-bit Systems","x64-based Systems"],"product":"Microsoft Office LTSC 2024","vendor":"Microsoft","versions":[{"lessThan":"https://aka.ms/OfficeSecurityReleases","status":"affected","version":"16.0.0","versionType":"custom"}]}
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:f97b91f32f1e68c31be726cb2f0d9c7645e2973bff0c5fab64f76db8fb7dc34b · sha256:2a09fd35bec50b8a… · /containers/cna/affected/4
{"platforms":["32-bit Systems","x64-based Systems"],"product":"Microsoft Office 2016","vendor":"Microsoft","versions":[{"lessThan":"16.0.5539.1001","status":"affected","version":"16.0.0","versionType":"custom"}]}
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:f97b91f32f1e68c31be726cb2f0d9c7645e2973bff0c5fab64f76db8fb7dc34b · sha256:2a09fd35bec50b8a… · /containers/cna/affected/1
{"platforms":["32-bit Systems","x64-based Systems"],"product":"Microsoft 365 Apps for Enterprise","vendor":"Microsoft","versions":[{"lessThan":"https://aka.ms/OfficeSecurityReleases","status":"affected","version":"16.0.1","versionType":"custom"}]}
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:f97b91f32f1e68c31be726cb2f0d9c7645e2973bff0c5fab64f76db8fb7dc34b · sha256:2a09fd35bec50b8a… · /containers/cna/affected/0
{"platforms":["32-bit Systems","x64-based Systems"],"product":"Microsoft Office LTSC 2021","vendor":"Microsoft","versions":[{"lessThan":"https://aka.ms/OfficeSecurityReleases","status":"affected","version":"16.0.1","versionType":"custom"}]}
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:f97b91f32f1e68c31be726cb2f0d9c7645e2973bff0c5fab64f76db8fb7dc34b · sha256:2a09fd35bec50b8a… · /containers/cna/affected/3
{"platforms":["32-bit Systems","x64-based Systems"],"product":"Microsoft Office 2019","vendor":"Microsoft","versions":[{"lessThan":"16.0.10417.20095","status":"affected","version":"19.0.0","versionType":"custom"}]}
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:f97b91f32f1e68c31be726cb2f0d9c7645e2973bff0c5fab64f76db8fb7dc34b · sha256:2a09fd35bec50b8a… · /containers/cna/affected/2

Provider-owned CVSS observations

1 source assertion
{"metric":{"baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C","version":"3.1"},"metric_type":"cvssV3_1"}
  • cve_program_cvelist_v5cvss
    urn:baitaphish:normalized-source-record:v2:f97b91f32f1e68c31be726cb2f0d9c7645e2973bff0c5fab64f76db8fb7dc34b · sha256:2a09fd35bec50b8a… · /containers/cna/metrics/0/cvssV3_1

CWE assertions

1 source assertion
{"cweId":"CWE-807","description":"CWE-807: Reliance on Untrusted Inputs in a Security Decision","lang":"en-US","type":"CWE"}
  • cve_program_cvelist_v5cwe
    urn:baitaphish:normalized-source-record:v2:f97b91f32f1e68c31be726cb2f0d9c7645e2973bff0c5fab64f76db8fb7dc34b · sha256:2a09fd35bec50b8a… · /containers/cna/problemTypes/0/descriptions/0

Known exploitation assertions

2 source assertions
{"cwes":["CWE-807"],"dateAdded":"2026-01-26","dueDate":"2026-02-16","knownRansomwareCampaignUse":"Unknown","notes":"Please adhere to Microsoft’s recommended guidelines to address this vulnerability. Implement all final mitigations provided by the vendor for Office 2021, and apply the interim corresponding mitigations for Office 2016 and Office 2019 until the final patch becomes available. For more information please see: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21509 ; https://nvd.nist.gov/vuln/detail/CVE-2026-21509","product":"Office","requiredAction":"Apply mitigations …
  • cisa_kev_jsonknown_exploited
    urn:baitaphish:normalized-source-record:v2:2b29b8ced7ead4e226260465d890ed39b4af5e761d04018b789b1818589b959d · sha256:635dff916c4092c0… · /vulnerabilities/165
    Open source location →
{"cwes":["CWE-807"],"dateAdded":"2026-01-26","dueDate":"2026-02-16","knownRansomwareCampaignUse":"Unknown","notes":"Please adhere to Microsoft’s recommended guidelines to address this vulnerability. Implement all final mitigations provided by the vendor for Office 2021, and apply the interim corresponding mitigations for Office 2016 and Office 2019 until the final patch becomes available. For more information please see: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21509 ; https://nvd.nist.gov/vuln/detail/CVE-2026-21509","product":"Office","requiredAction":"Apply mitigations …
  • cisa_kev_jsonknown_exploited
    urn:baitaphish:normalized-source-record:v2:fb810d2a9be9436b48325aace2aa80cb71361af4f192f359c36818dceb8e2d3f · sha256:16acee8334e59e44… · /vulnerabilities/162
    Open source location →

Source references

4 source assertions
{"name":"Microsoft Office Security Feature Bypass Vulnerability","tags":["vendor-advisory","patch"],"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21509"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:f97b91f32f1e68c31be726cb2f0d9c7645e2973bff0c5fab64f76db8fb7dc34b · sha256:2a09fd35bec50b8a… · /containers/cna/references/0
{"tags":["government-resource"],"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-21509"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:f97b91f32f1e68c31be726cb2f0d9c7645e2973bff0c5fab64f76db8fb7dc34b · sha256:2a09fd35bec50b8a… · /containers/adp/0/references/0
{"url":"https://www.vicarius.io/vsociety/posts/cve-2026-21509-detection-script-microsoft-office-security-feature-bypass-vulnerability"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:f97b91f32f1e68c31be726cb2f0d9c7645e2973bff0c5fab64f76db8fb7dc34b · sha256:2a09fd35bec50b8a… · /containers/adp/1/references/0
{"url":"https://www.vicarius.io/vsociety/posts/cve-2026-21509-mitigation-script-microsoft-office-security-feature-bypass-vulnerability"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:f97b91f32f1e68c31be726cb2f0d9c7645e2973bff0c5fab64f76db8fb7dc34b · sha256:2a09fd35bec50b8a… · /containers/adp/1/references/1

Attribution and limitations

  • CISA Known Exploited Vulnerabilities JSON: CISA named for provenance; do not use CISA/DHS marks or imply endorsement Source →
  • CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer