office zero-day gets a service-side fix — restart required
Microsoft fixed an exploited Office bug that bypasses OLE protections when a user opens a malicious document.
- cve
- CVE-2026-21509
- cvss
- 7.8 (v3.1, Microsoft)
- affected
- Office 2016 and 2019 (need the security update); Office 2021 and later (service-side fix)
- fixed in
- service-side change for Office 2021+ (after app restart); Office 2016 build 16.0.5539.1001; Office 2019 build 16.0.10417.20095
- exploited
- yes — added to CISA KEV 2026-01-26
what happened
- Microsoft published CVE-2026-21509, a Microsoft Office security feature bypass, on 2026-01-26 and marked it "Exploitation Detected".[1]
- The flaw bypasses OLE mitigations in Microsoft 365 and Microsoft Office that protect users from vulnerable COM/OLE controls; an attacker must send a malicious Office file and persuade the user to open it, and the Preview Pane is not an attack vector.[1]
- Microsoft rated it 7.8 under CVSS v3.1 (CWE-807, reliance on untrusted inputs in a security decision).[1,2]
- Office 2021 and later are protected by a service-side change, but users must restart their Office applications for it to take effect.[1]
- Office 2016 and 2019 are not protected until the security update is installed; fixed builds are 16.0.5539.1001 (Office 2016) and 16.0.10417.20095 (Office 2019).[1]
- CISA added CVE-2026-21509 to KEV on 2026-01-26 with a 2026-02-16 due date.[2]
where sources differMicrosoft's advisory gives a registry workaround for Office 2016/2019 in one mitigation section, while a later section states the registry keys do not apply to Office 2016 or 2019.
sources2
- 01CVE-2026-21509: Microsoft Office Security Feature Bypass Vulnerability (Security Update Guide API) ↗ primaryMicrosoft Security Response Centeraccessed 2026-10-21
- 02NVD CVE API record for CVE-2026-21509 ↗ primaryNIST NVDaccessed 2026-10-21