Microsoft Office vulnerability (CVE-2026-21509) in active exploitation

On January 26, 2026, Microsoft released an out-of-band update to address a high-severity (CVSS score of 7.8) vulnerability affecting multiple Microsoft Office products. This vulnerability, tracked as CVE-2026-21509, is being actively exploited in the wild and has been added to CISA’s Known Exploited Vulnerabilities (KEV) Catalog.

The issue stems from the application’s “reliance on untrusted inputs when making security decisions”, which allows attackers to bypass Object Linking and Embedding (OLE) security mitigations built into Microsoft Office and Microsoft 365. Exploitation requires an attacker to convince a user to open a specially crafted malicious Office file.

Affected software includes Microsoft Office 2016, Microsoft Office 2019, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, and Microsoft 365 Apps for Enterprise.

Recommended actions

Organizations should identify vulnerable Microsoft Office instances in their environments and apply updates or mitigations as appropriate. Microsoft recommends implementing protections as soon as possible given the active exploitation.

Sophos actions

SophosLabs is investigating the feasibility of detections for this threat.

About Author

AndyC

Andy Curtis is an award-winning security consultant, researcher and public speaker. He has been working in the computer security industry since the early 1990s, having been employed by state and federal government, leading healthcare and banking providers across three continents. He has given talks about computer security for some of the world’s largest companies, worked with law enforcement agencies on investigations into hacking groups, and is a regular voice on TV and radio explaining IT security threats.

See author's posts