Microsoft reveals actively exploited Office zero-day, provides emergency fix (CVE-2026-21509)

Back Helpnetsecurity

Microsoft reveals actively exploited Office zero-day, provides emergency fix (CVE-2026-21509)

Helpnetsecurity • January 27, 2026

Share: View original

Microsoft released emergency Office security updates to fix a zero - day vulnerability (CVE-2026-21509) actively exploited by attackers.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Microsoft Office 0-day Vulnerability CVE-2026-21509 Exploited; Emergency Fix Released Microsoft Office 2016 to 2024 and Office 365 apps are affected by a zero-day vulnerability (CVE-2026-21509) that is currently being exploited in attacks. Microsoft has released emergency security updates to address this issue. 7 sources 94

Extracted Entities

Attack Types (1)

Zero-day Exploit

Companies (1)

CVEs (1)

Platforms (1)

Microsoft Office