CVE-2026-21509

CVE Enrichment

CVSS: 7.8 HIGH
EPSS: 70.80%
EPSS Percentile: 99.39%
CISA KEV: YES — Known Exploited Vulnerability

Description

Reliance on untrusted inputs in a security decision in Microsoft Office allows an unauthorized attacker to bypass a security feature locally.

Technical Details

CVSS Version: 3.1
CNA / NVD Source: secure@microsoft.com
Published: 27-Jan-2026 01:16
Last Modified: 25-Jun-2026 12:16
EPSS Date: 2026-10-12
CWE: CWE-807

CVSS Vector


            CVSS:3.1                            AV:L /
                            AC:L /
                            PR:N /
                            UI:R /
                            S:U /
                            C:H /
                            I:H /
                            A:H

CISA KEV Details

Date Added: 2026-01-26
Remediation Due: 2026-02-16
Known Ransomware Campaign Use: Unknown
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Notes: Please adhere to Microsoft’s recommended guidelines to address this vulnerability. Implement all final mitigations provided by the vendor for Office 2021, and apply the interim corresponding mitigations for Office 2016 and Office 2019 until the final patch becomes available. For more information please see: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21509 ; https://nvd.nist.gov/vuln/detail/CVE-2026-21509

Affected Products / Versions

microsoft / 365_apps
Version / affected range: -
cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:x64:*
microsoft / 365_apps
Version / affected range: -
cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:x86:*
microsoft / office
Version / affected range: 2016
cpe:2.3:a:microsoft:office:2016:*:*:*:*:*:x64:*
microsoft / office
Version / affected range: 2016
cpe:2.3:a:microsoft:office:2016:*:*:*:*:*:x86:*
microsoft / office
Version / affected range: 2019
cpe:2.3:a:microsoft:office:2019:*:*:*:*:*:x64:*
microsoft / office
Version / affected range: 2019
cpe:2.3:a:microsoft:office:2019:*:*:*:*:*:x86:*
microsoft / office_long_term_servicing_channel
Version / affected range: 2021
cpe:2.3:a:microsoft:office_long_term_servicing_channel:2021:*:*:*:*:-:x64:*
microsoft / office_long_term_servicing_channel
Version / affected range: 2021
cpe:2.3:a:microsoft:office_long_term_servicing_channel:2021:*:*:*:*:-:x86:*
microsoft / office_long_term_servicing_channel
Version / affected range: 2024
cpe:2.3:a:microsoft:office_long_term_servicing_channel:2024:*:*:*:*:-:x64:*
microsoft / office_long_term_servicing_channel
Version / affected range: 2024
cpe:2.3:a:microsoft:office_long_term_servicing_channel:2024:*:*:*:*:-:x86:*

References

Last enrichment sync: 13-Oct-2026 08:30
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (3)

CVE-2026-21509 Recorded Future Reported 59 High-Impact Vulnerabilities in June, 56 Actively Exploited
exploits: Pawn Storm’s campaign in late January 2026 exploited the Microsoft Office vulnerability CVE-2026-21509 to target government, military, and critical infrastructure entities across Central and Eastern Pawn Storm Uses PRISMEX Malware and Exploits Microsoft Office Vulnerability in Campaign Targeting Ukraine and Allies
region. In this campaign, the threat actor leveraged specially crafted Microsoft RTF files to exploit CVE-2026-21509 and deliver malicious backdoors in a multi-stage infection chain. Due to significant overlaps in APT28 Used CVE-2026-21509 to Deploy Email-Stealing and Backdoor Malware in Eastern Europe

CVE (55)

Malware (15)

Threat Actors (11)

MITRE ATT&CK (13)

Vendors (26)

Products (60)

Tools (5)

Industries (8)

Countries (9)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.