CVE-2026-21509High· 7.8▾ Abyssal⚠ Exploited in the wild0dayPoC availableReliance on untrusted inputs in a security decision in Microsoft Office allows an unauthorized attacker to bypass a security feature locally.
▾ Abyssal zone — Critical with a public exploit or in-the-wild use
impact 42.9 · likelihood 14.2 · exploitation 25
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Exploit-prediction probability, daily snapshots since Aug 4.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Federal remediation due Feb 16, 2026
Last analysed / modified upstream
72%
13 GitHub repos
72% → 73%
Added to the CISA catalog on Jan 26, 2026. Federal remediation due Feb 16, 2026. View catalog ↗
Reliance on untrusted inputs in a security decision in Microsoft Office allows an unauthorized attacker to bypass a security feature locally.
365_appsoffice = 2016office = 2019office_long_term_servicing_channel = 2021office_long_term_servicing_channel = 2024Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2023-35311High· 8.8Microsoft Outlook Security Feature Bypass Vulnerability
CVE-2021-42292High· 7.8Microsoft Excel Security Feature Bypass Vulnerability
CVE-2026-88210High· 7.8Reliance on untrusted inputs in a security decision in Microsoft Office Word allows an unauthorized attacker to bypass a security feature locally.
CVE-2021-38646High· 7.8Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability
CVE-2023-35636Medium· 6.5Microsoft Outlook Information Disclosure Vulnerability
CVE-2026-108433High· 7.8Microsoft Office Word Security Feature Bypass Vulnerability