Microsoft has issued an urgent security update to address a high-severity zero-day vulnerability in Microsoft Office, identified as CVE-2026-21509. This vulnerability, which has been actively exploited in attacks, is a security feature bypass that poses significant risks to users. With a CVSS score of 7.8 out of 10, it underscores the critical nature of the flaw.
Understanding the Vulnerability
The vulnerability allows unauthorized attackers to bypass security features locally by exploiting untrusted inputs in a security decision within Microsoft Office. The flaw specifically bypasses OLE mitigations in Microsoft 365 and Microsoft Office, which are designed to protect users from vulnerable COM/OLE controls. Exploitation requires an attacker to send a specially crafted Office file and convince the recipient to open it. Notably, the Preview Pane is not an attack vector.
Patch Implementation
For users running Office 2021 and later, protection is automatically applied via a service-side change, though a restart of Office applications is necessary for the update to take effect. Users of Office 2016 and 2019 must manually install specific updates to secure their systems:
- Microsoft Office 2019 (32-bit edition) – 16.0.10417.20095
- Microsoft Office 2019 (64-bit edition) – 16.0.10417.20095
- Microsoft Office 2016 (32-bit edition) – 16.0.5539.1001
- Microsoft Office 2016 (64-bit edition) – 16.0.5539.1001
Mitigation Steps
Microsoft advises users to make a Windows Registry change as a mitigation measure. This involves backing up the Registry, exiting all Office applications, and using the Registry Editor to locate the appropriate registry subkey. Users must add a new subkey named {EAB22AC3-30C1-11CF-A7EB-0000C05BAE0B} and set a REG_DWORD hexadecimal value called \”Compatibility Flags\” with a value of 400.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added this vulnerability to its Known Exploited Vulnerabilities catalog, mandating Federal Civilian Executive Branch agencies to apply the patches by February 16, 2026. Microsoft has credited its Threat Intelligence Center, Security Response Center, and Office Product Group Security Team for identifying the issue. Business owners and startup founders are urged to implement these updates promptly to safeguard their operations from potential threats.
