{"id":"CVE-2026-21509","published":"2026-01-26T18:16:38Z","modified":"2026-06-25T05:16:53Z","title":"Microsoft Office Security Feature Bypass Vulnerability","vendor":"Microsoft","product":"Office","tier":"core","eol":null,"description":{"text":"Reliance on untrusted inputs in a security decision in Microsoft Office allows an unauthorized attacker to bypass a security feature locally.","provenance":"source","from":"NVD"},"summary":{"text":"Microsoft Office contains a flaw in which a security decision relies on untrusted inputs, which is classed as reliance on untrusted inputs in a security decision. An unauthorised attacker who has local access can bypass a security feature, provided a user interacts with the crafted content.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:12:59Z"},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.70795,"percentile":0.99398,"date":"2026-10-30","provenance":"source"},"kev":{"dateAdded":"2026-01-26","dueDate":"2026-02-16","ransomware":false,"requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"Please adhere to Microsoft’s recommended guidelines to address this vulnerability. Implement all final mitigations provided by the vendor for Office 2021, and apply the interim corresponding mitigations for Office 2016 and Office 2019 until the final patch becomes available. For more information please see: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21509 ; https://nvd.nist.gov/vuln/detail/CVE-2026-21509","provenance":"source"},"vulncheckKev":{"dateAdded":"2026-01-26","exploitedFirstSeen":"2026-01-26","ransomware":false,"evidence":[{"url":"https://api.msrc.microsoft.com/cvrf/v3.0/cvrf/2026-Jan","date":"2026-01-26"},{"url":"https://docs.google.com/spreadsheets/d/1lkNJ0uQwbeC1ZTRrxdtuPLCIl7mlUreoKfSIgajnSyY/edit","date":"2026-01-26"},{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21509","date":"2026-01-26"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2026-01-26"},{"url":"https://cert.gov.ua/article/6287250","date":"2026-02-01"},{"url":"https://www.zscaler.com/blogs/security-research/apt28-leverages-cve-2026-21509-operation-neusploit","date":"2026-02-02"},{"url":"https://blog.synapticsystems.de/apt28-geofencing-as-a-targeting-signal-cve-2026-21509/","date":"2026-02-04"},{"url":"https://www.trellix.com/blogs/research/apt28-stealthy-campaign-leveraging-cve-2026-21509-cloud-c2/","date":"2026-02-04"},{"url":"https://strikeready.com/blog/apt28s-campaign-leveraging-cve%E2%80%912026%E2%80%9121509-and-cloud-c2-infrastructure/","date":"2026-02-05"},{"url":"https://blog.polyswarm.io/fancy-bear-leveraging-cve-2026-21509-in-operation-neusploit","date":"2026-02-09"}],"evidenceTotal":30,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 31, 2026","url":"https://otx.alienvault.com/pulse/6ae4aefab0c2191cecd41862","created":"2026-10-30"},{"name":"Actively_Exploited_Kev | Oct 30, 2026","url":"https://otx.alienvault.com/pulse/6ae35d889ea92b4ce19c2680","created":"2026-10-29"},{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"}],"provenance":"machine"},"cwes":[{"id":"CWE-807","name":"Reliance on Untrusted Inputs in a Security Decision"}],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21509","tags":["Vendor Advisory"]},{"url":"https://www.vicarius.io/vsociety/posts/cve-2026-21509-detection-script-microsoft-office-security-feature-bypass-vulnerability","tags":["Third Party Advisory"]},{"url":"https://www.vicarius.io/vsociety/posts/cve-2026-21509-mitigation-script-microsoft-office-security-feature-bypass-vulnerability","tags":["Mitigation","Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-21509","tags":["US Government Resource"]}],"techniques":[{"id":"T1204.002","name":"Malicious File","tactics":["execution"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: local attack requiring user interaction (UI:R)","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"allows an unauthorized attacker to bypass a security feature locally","start":72,"end":140}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1211","name":"Exploitation for Stealth","tactics":["stealth"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: bypasses security feature, defense evasion","mappingType":"primary_impact","evidence":[{"from":"description","quote":"allows an unauthorized attacker to bypass a security feature","start":72,"end":132}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2026-4666","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-4666","exploited":true,"exploitedSince":"2026-01-26","provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":12,"skipped":1,"earliest":"2026-01-27","earliestUrl":"https://github.com/kimstars/Ashwesker-CVE-2026-21509","repos":[{"name":"gavz/CVE-2026-21509-PoC","url":"https://github.com/gavz/CVE-2026-21509-PoC","stars":42,"created":"2026-01-29"},{"name":"kimstars/Ashwesker-CVE-2026-21509","url":"https://github.com/kimstars/Ashwesker-CVE-2026-21509","stars":12,"created":"2026-01-27"},{"name":"suuhm/CVE-2026-21509-handler","url":"https://github.com/suuhm/CVE-2026-21509-handler","stars":8,"created":"2026-03-01"},{"name":"SimoesCTT/CTT-NFS-Vortex-RCE","url":"https://github.com/SimoesCTT/CTT-NFS-Vortex-RCE","stars":3,"created":"2026-01-31"},{"name":"SimoesCTT/CTT-MICROSOFT-OFFICE-OLE-MANIFOLD-BYPASS-CVE-2026-21509","url":"https://github.com/SimoesCTT/CTT-MICROSOFT-OFFICE-OLE-MANIFOLD-BYPASS-CVE-2026-21509","stars":3,"created":"2026-02-01"}]},"first":{"date":"2026-01-27","source":"PoC-in-GitHub","url":"https://github.com/kimstars/Ashwesker-CVE-2026-21509"},"provenance":"source"},"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1204.002"],"provenance":"ai"},{"stage":"primary","techniques":["T1211"],"provenance":"ai"}],"timeline":[{"date":"2026-01-26","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-21509","provenance":"source"},{"date":"2026-01-26","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://api.msrc.microsoft.com/cvrf/v3.0/cvrf/2026-Jan","provenance":"source"},{"date":"2026-01-26","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2026-01-26","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-4666","provenance":"source"},{"date":"2026-01-27","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/kimstars/Ashwesker-CVE-2026-21509","provenance":"source"}],"speed":{"daysToPublicExploit":1,"firstExploitFrom":"PoC-in-GitHub","daysToKev":0},"priority":{"score":73.3,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":5.0,"detail":"added 278 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.88,"detail":"percentile 0.9940"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"12 PoC-in-GitHub repos"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":5.46,"detail":"base score 7.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}