CVE-2026-21509 - Vulnerability Details - OpenCVE

Reliance on untrusted inputs in a security decision in Microsoft Office allows an unauthorized attacker to bypass a security feature locally.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

Vendors	Products
Microsoft	365 Apps Office 2016 Office 2019 Office 2021 Office 2024

No data.

No data.

No data.

References

Link	Providers
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21509

History

Mon, 26 Jan 2026 17:30:00 +0000

Type	Values Removed	Values Added
Description		Reliance on untrusted inputs in a security decision in Microsoft Office allows an unauthorized attacker to bypass a security feature locally.
Title		Microsoft Office Security Feature Bypass Vulnerability
First Time appeared		Microsoft Microsoft 365 Apps Microsoft office 2016 Microsoft office 2019 Microsoft office 2021 Microsoft office 2024
Weaknesses		CWE-807
CPEs		cpe:2.3:a:microsoft:365_apps:::::enterprise:::* cpe:2.3:a:microsoft:office_2016:::::::x86:* cpe:2.3:a:microsoft:office_2019:::::::: cpe:2.3:a:microsoft:office_2021:::::long_term_servicing_channel:::* cpe:2.3:a:microsoft:office_2024:::::long_term_servicing_channel:::*
Vendors & Products		Microsoft Microsoft 365 Apps Microsoft office 2016 Microsoft office 2019 Microsoft office 2021 Microsoft office 2024
References		https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21509
Metrics		cvssV3_1 `{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C'}`

MITRE

Status: PUBLISHED

Assigner: microsoft

Published: 2026-01-26T17:06:35.512Z

Updated: 2026-01-26T18:38:53.676Z

Reserved: 2025-12-30T18:10:54.844Z

Link: CVE-2026-21509

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-01-26T18:16:38.540

Modified: 2026-01-26T18:16:38.540

Link: CVE-2026-21509

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-21509", "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "state": "PUBLISHED", "assignerShortName": "microsoft", "dateReserved": "2025-12-30T18:10:54.844Z", "datePublished": "2026-01-26T17:06:35.512Z", "dateUpdated": "2026-01-26T18:38:53.676Z"}, "containers": {"cna": {"title": "Microsoft Office Security Feature Bypass Vulnerability", "datePublic": "2026-01-26T08:00:00.000Z", "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:office_2019:*:*:*:*:*:*:*:*", "versionStartIncluding": "-"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:365_apps:*:*:*:*:enterprise:*:*:*", "versionStartIncluding": "16.0.1", "versionEndExcluding": "https://aka.ms/OfficeSecurityReleases"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:office_2021:*:*:*:*:long_term_servicing_channel:*:*:*", "versionStartIncluding": "16.0.1", "versionEndExcluding": "https://aka.ms/OfficeSecurityReleases"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:office_2024:*:*:*:*:long_term_servicing_channel:*:*:*", "versionStartIncluding": "16.0.0", "versionEndExcluding": "https://aka.ms/OfficeSecurityReleases"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:office_2016:*:*:*:*:*:*:x86:*", "versionStartIncluding": "-"}]}]}], "affected": [{"vendor": "Microsoft", "product": "Microsoft Office 2019", "platforms": ["32-bit Systems", "x64-based Systems"], "versions": [{"version": "-", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Microsoft 365 Apps for Enterprise", "platforms": ["32-bit Systems", "x64-based Systems"], "versions": [{"version": "16.0.1", "lessThan": "https://aka.ms/OfficeSecurityReleases", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Microsoft Office LTSC 2021", "platforms": ["x64-based Systems", "32-bit Systems"], "versions": [{"version": "16.0.1", "lessThan": "https://aka.ms/OfficeSecurityReleases", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Microsoft Office LTSC 2024", "platforms": ["32-bit Systems", "x64-based Systems"], "versions": [{"version": "16.0.0", "lessThan": "https://aka.ms/OfficeSecurityReleases", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Microsoft Office 2016", "platforms": ["32-bit Systems", "x64-based Systems"], "versions": [{"version": "-", "status": "affected"}]}], "descriptions": [{"value": "Reliance on untrusted inputs in a security decision in Microsoft Office allows an unauthorized attacker to bypass a security feature locally.", "lang": "en-US"}], "problemTypes": [{"descriptions": [{"description": "CWE-807: Reliance on Untrusted Inputs in a Security Decision", "lang": "en-US", "type": "CWE", "cweId": "CWE-807"}]}], "providerMetadata": {"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "shortName": "microsoft", "dateUpdated": "2026-01-26T18:38:53.676Z"}, "references": [{"name": "Microsoft Office Security Feature Bypass Vulnerability", "tags": ["vendor-advisory", "patch"], "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21509"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en-US", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "baseSeverity": "HIGH", "baseScore": 7.8, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C"}}]}}}