Microsoft Issues Out-of-Band Security Update for High-Severity Office Zero-Day (CVE-2026-21509)

Warning: Active Attacks Exploiting Microsoft Office Flaw; Legacy Versions Await Patches.

Microsoft has released an emergency Out-of-band (OOB) security update to address a critical Zero-Day vulnerability in Microsoft Office. The flaw, identified as CVE-2026-21509, is currently being exploited in the wild and carries a high-severity CVSS score of 7.8/10.

Technical Breakdown: OLE Security Feature Bypass

The vulnerability is classified as a Security Feature Bypass. It stems from an improper trust validation within Office, allowing attackers to circumvent OLE (Object Linking and Embedding) protections. These safeguards were originally designed to block malicious interactions from compromised COM/OLE controls.

By bypassing these features, an attacker can execute unauthorized code or plant malware on a victim's system.

Attack Vector: Social Engineering Required

To successfully exploit this flaw, an attacker must convince a user to open a specially crafted Office file (such as a Word or Excel document) containing the malicious payload. Unlike some "zero-click" vulnerabilities, this attack requires user interaction, making it a prime tool for targeted phishing campaigns.

Affected Versions

The vulnerability impacts a wide range of Microsoft Office products:

• Office 2016 & Office 2019

• Office LTSC 2021 & Office LTSC 2024

• Microsoft 365 Apps for Enterprise

Note: Microsoft clarifies that simply viewing a file in the Windows Explorer Preview Pane does not trigger the exploit. The file must be fully opened within the application.

Patch Status and Temporary Mitigations

• Microsoft 365 & Office 2021/2024: Patches are available now and should be applied automatically via Office Updates.

• Office 2016 & 2019: These versions do not have an immediate patch. Microsoft has stated that updates for these legacy versions will be released as soon as possible.

Interim Mitigation: IT Administrators can mitigate the risk by modifying the Windows Registry to disable specific COM objects associated with the vulnerability. However, this is a temporary measure as it may impact the functionality of certain embedded features within Office.

Even though Microsoft has disabled macros by default, hackers are still trying to find loopholes through OLE/COM, an older but powerful technology for cross-application data connections. This vulnerability proves that "legacy code" remains a favorite weakness for hackers in 2026.

Microsoft typically releases updates on the second Tuesday of the month (Patch Tuesday), but out-of-band releases mean that severe and rapidly spreading attacks have been detected, making it impossible to wait for the regular release schedule.

The fact that Office 2016 and 2019 are not immediately patched underscores the risk of using older software versions. Hackers often target groups that are "slow to update" or "lacking patches" during this zero-day window to maximize damage.

In addition to patching, using Microsoft Defender for Office 365 with the "Safe Attachments" feature enabled scans and opens files in a sandbox environment before they reach users, providing the best possible protection against this type of vulnerability.

 

Update Now! WinRAR Version 7.13 Patches Flaw Used by Global Espionage Groups.

 

Source: bleepingcomputer