Microsoft Office Emergency Out-of-Band Update: CVE-2026-21509

THE THREAT

On January 26th, 2026, Microsoft issued an emergency out-of-band security update to remediate a high-severity zero-day vulnerability in Microsoft Office. The vulnerability, identified as CVE-2026-21509 (CVSS: 7.8), stems from improper reliance on untrusted input in a security decision-making process. This flaw allows an unauthenticated attacker to bypass built-in security features locally by sending and convincing a user to open specially crafted Office documents. Successful exploitation could result in serious security impacts, including credential harvesting through phishing attacks and potential Remote Code Execution (RCE). 

Microsoft has confirmed active exploitation of this vulnerability following an internal investigation and has verified the existence of functional Proof-of-Concept (PoC) exploit code. Given the confirmed in-the-wild exploitation, organizations using affected versions of Microsoft Office are strongly advised to apply the relevant security updates immediately.

What we’re doing about it

• eSentire Managed Vulnerability Service (MVS) will add the relevant plugins as they become available
• The eSentire Threat Intelligence team is tracking the vulnerability for additional details and detection opportunities

What you should do about it

• Apply the relevant security updates immediately
• Until the updates are applied on Microsoft Office 2016 and 2019, organizations must implement the recommended registry key modifications as an interim mitigation
  • Instructions for the required registry changes are provided under Mitigations in Microsoft’s official patch documentation
• Microsoft Office 2021 and later applications are required to be restarted once
• Be cautious before downloading files from unverified or unknown sources

Additional information

CVE-2026-21509 affects multiple versions of Microsoft Office, including Microsoft Office 2016, Microsoft Office 2019, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, and Microsoft 365 Apps for Enterprise. The patch addresses the flaw in OLE mitigations within Microsoft 365 and Microsoft Office that are designed to protect users from vulnerable COM/OLE controls. Microsoft Office 2021 and later versions are automatically protected through service-side mitigations deployed by Microsoft; however, users are required to restart their Office applications for the protections to take effect. 

If security patches cannot be applied immediately on Office 2016 and 2019, organizations should implement Microsoft's recommended registry change as a temporary risk-reduction measure. Before making any changes, ensure the Windows Registry is backed up and all Office applications are closed. Administrators must then create or update a specific registry key under the Office COM Compatibility path and add a configuration value to block the vulnerable component. Microsoft provides detailed, step-by-step instructions and the exact registry paths in the Mitigations section of the official security update document. 

The Cybersecurity and Infrastructure Security Agency (CISA) has added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, requiring U.S. federal agencies to remediate the issue by February 16th, 2026. Although neither Microsoft nor CISA has released detailed technical information regarding the observed exploitation, the issuance of an emergency out-of-band update by Microsoft underscores the severity and urgency of this threat. The eSentire Threat Intelligence team assesses that that this vulnerability may have been exploited against targeted victims, or that the threat actor(s) responsible for its initial use were of particular significance. 

References:
[1] https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21509 
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-21509 
[3] https://www.cisa.gov/news-events/alerts/2026/01/26/cisa-adds-five-known-exploited-vulnerabilities-catalog