EXPOSURES › CVE-2026-21509
CVE-2026-21509
HIGH ⌖ ON CISA KEV · EXPLOITEDMicrosoft Office flaw exploited, users advised to transition to supported versions.
A critical security feature bypass vulnerability in Microsoft Office allowed unauthorized attackers to bypass security features locally. Users are advised to stop using affected, unsupported versions and transition to supported ones to prevent potential unauthorized access.
Shame score — Critical vulnerability actively exploited in the wild with no patch available for unsupported, end-of-life versions.
▸ RECOMMENDED ACTION Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.
Microsoft Office contains a security feature bypass vulnerability in which reliance on untrusted inputs in a security decision in Microsoft Office could allow an unauthorized attacker to bypass a security feature locally. Some of the impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version.
| PRODUCT | STATUS |
|---|---|
| Azure Commercial Cloud Microsoft |
Authorized |
| Azure Government (includes Dynamics 365) Microsoft |
Authorized |
| Microsoft Office 365 GCC High Microsoft |
In Process |
| Office 365 Multi-Tenant & Supporting Services Microsoft |
Authorized |