Microsoft has released emergency out-of-band security updates to address a high severity vulnerability (CVE-2026-21509) affecting their Microsoft Office products.
Microsoft has released emergency out-of-band security updates to address a high severity vulnerability (CVE-2026-21509) affecting their Microsoft Office products.
Successful exploitation of the security feature bypass vulnerability could allow an attacker to bypass Microsoft Office security mitigations once a user is tricked into opening a malicious Office file. A local unauthenticated attacker can then gain access to the computer, and steal files or install malware.
The vulnerability affects the following products:
Microsoft Office 2016
Microsoft Office 2019
Microsoft Office LTSC 2021
Microsoft Office LTSC 2024
Microsoft 365 Apps for Enterprise
The vulnerability is reportedly being exploited in the wild.
Users and administrators running Microsoft Office 2021 and later versions are advised to restart their Office applications to be automatically secured. Users and administrators of Office 2016 and 2019 are advised to update to the latest version immediately.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
