Microsoft Office Zero

Cybersecuritynews •Guru Baran • January 27, 2026

Microsoft released emergency out-of-band security updates on January 26, 2026, to address CVE-2026-21509, a zero-day security feature bypass vulnerability in Microsoft Office that attackers are actively exploiting. The flaw, rated “Important” with a CVSS v3.1 base score of 7.8, relies on untrusted inputs in security decisions to circumvent OLE mitigations protecting against vulnerable COM/OLE controls. […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Microsoft Office Zero-Day Vulnerability Exploited On January 26, 2026, Microsoft released emergency out-of-band security updates to address CVE-2026-21509, a zero-day security feature bypass vulnerability in Microsoft Office. The flaw, rated 'Important' with a CVSS v3.1 base score of 7.8, allows attackers to exploit untrusted inputs in security decisions, circumventing OLE mitigations for vulnerable COM/OLE controls. 2 sources 36

Extracted Entities

Microsoft Office Zero

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

Platforms (1)