Microsoft Office Zero-Day Vulnerability Exploited

Microsoft Office Zero-Day Vulnerability Exploited

First seen 29 Jan 2026, 22:04 UTC •CybersecuritynewsBlog.Malwarebytes •36.4

Article Content

Browse articles
ThreatCluster

On January 26, 2026, Microsoft released emergency out-of-band security updates to address CVE-2026-21509, a zero-day security feature bypass vulnerability in Microsoft Office. The flaw, rated 'Important' with a CVSS v3.1 base score of 7.8, allows attackers to exploit untrusted inputs in security decisions, circumventing OLE mitigations for vulnerable COM/OLE controls.

How this analysis works

Extracted Entities

1 / 2