Microsoft Office vulnerability (CVE-2026-21509) in active exploitation

Sophos • January 27, 2026

The issue stems from the application's "reliance on untrusted inputs when making security decisions", which allows attackers to bypass Object Linking ...

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Microsoft Office Vulnerability CVE-2026-21509 Under Active Exploitation A critical vulnerability (CVE-2026-21509) in Microsoft Office has been identified, allowing attackers to exploit the application's reliance on untrusted inputs for security decisions. This flaw enables the bypassing of Object Linking and Embedding (OLE) protections, potentially affecting numerous users. Immediate action is recommended to mitigate risks associated with this vulnerability. 1 sources 49

Extracted Entities

CVEs (1)

CVE-2026-21509

Platforms (1)

Microsoft Office