CVE-2026-21509 – Microsoft Office: Actively Exploited Bypass of OLE Protections
A vulnerability in Microsoft Office lets crafted documents bypass the protections for OLE and COM controls. It was actively exploited as a zero-day. Microsoft released an emergency update at the end of January.
Update of October 22, 2026
We have corrected this advisory. Microsoft classifies CVE-2026-21509 as a security feature bypass with CVSS 7.8 (previously described here as critical remote code execution). More Office versions are affected than first stated, and the fix was released as an out-of-band emergency update.
What happened?
CVE-2026-21509 is a vulnerability in Microsoft Office in which Office relies on untrusted input for a security decision. A crafted document can thereby bypass the protections meant to block dangerous OLE and COM controls, opening the way for attackers to run malicious code. Macros do not need to be enabled. The victim does have to open the file; the preview pane is not enough.
The flaw was exploited as a zero-day. Microsoft released an emergency update on January 26, 2026, and the US agency CISA lists it in its catalog of known exploited vulnerabilities.
Who is affected?
- Microsoft 365 Apps for Enterprise
- Microsoft Office LTSC 2021 and LTSC 2024
- Microsoft Office 2016 and Office 2019
- Particularly exposed: environments where updates roll out with a delay or Office is rarely restarted, and departments handling many external documents.
What needs to be done?
- Office 2021, LTSC 2024 and Microsoft 365 Apps: The protection is applied on the service side once the Office applications are restarted. Make sure Office has actually been restarted on every device, and keep installations up to date (File → Account → Update Options → Update Now).
- Office 2016 and 2019: Install the security updates provided by Microsoft. Where that isn't possible right away, Microsoft's advisory for CVE-2026-21509 describes a registry change that blocks the affected controls.
- Managed environments: Check in Intune or your software distribution that the updates have reached every device.
- Protected View: Make sure "Protected View" for attachments from the internet is enabled in the Office options.
- Raise awareness: Don't open unexpected Office attachments, even from known senders.
This advisory is for informational purposes. Contact us for an analysis of your update strategy.
Ready to know your attack surface?
Tell us briefly about your project. We'll come back with a concrete proposal.
Request a first call