CVE-2026-21514 is a word reliance on untrusted inputs in a security decision vulnerability in Microsoft Office. CISA added it to the Known Exploited Vulnerabilities catalogue on 10 February 2026, which means attackers have used it in real attacks. Organisations running the affected product should apply the vendor fix or mitigation as a priority.
How this vulnerability works in Microsoft Office Word
“Reliance on untrusted inputs in a security decision” means Word is making a trust or safety decision using data that an attacker can influence. In a document-processing product, that is dangerous because the file itself can become part of the control failure, not just the carrier for a malicious payload.
The practical issue is that the application may accept content, metadata, links, embedded objects, template references, or similar inputs as if they were trustworthy enough to influence execution, protection, or access decisions. Once that assumption is wrong, the document can steer the application into unsafe behavior without needing a separate privilege boundary to be crossed first.
Why this class of flaw is dangerous
This vulnerability class matters because office documents are routinely opened from email, collaboration platforms, shared drives, and external partners. A security decision made on attacker-controlled content can lead to code execution, sandbox escape paths, unwanted content retrieval, or other outcomes that turn a normal document into an attack trigger.
That is why exploitability, not just technical existence, drives priority. For known exploited issues, the safest assumption is that hostile content has already been adapted to real-world delivery channels. The CISA Known Exploited Vulnerabilities catalogue is the authoritative place to confirm current exploitation status and prioritisation context, while the vendor advisory remains the source for exact remediation details. See the CVE Program and NIST National Vulnerability Database for canonical record lookup.
How organisations assess exposure and reduce attack surface
Exposure assessment starts with basic asset inventory: where Microsoft Office Word is installed, which editions are in use, and whether those endpoints regularly handle untrusted documents from outside the organisation. That inventory should be paired with internet-exposure review, email gateway controls, and any business process that accepts documents from third parties.
Because exploitation often arrives through ordinary user workflows, organisations should also review previewing, protected-view behavior, add-in exposure, template handling, and any automation that opens Word files on behalf of users or services. Broader Microsoft 365 hardening, including policy and logging discipline, helps reduce the blast radius of a document-based trust failure. The Microsoft 365 Security Guide is useful context for baseline hardening, and the Endpoint Hardening Checklist helps translate that into endpoint controls.
Remediation, detection, and compromise review
When a fix or mitigation is available, treat it as urgent because this is a known exploited CVE, not a theoretical weakness. If patching must be delayed, compensating controls should focus on reducing document trust, limiting risky file sources, and tightening monitoring around file-open behavior and unusual child processes or network activity after Word launches.
After remediation, organisations should review for post-patch compromise rather than assuming the issue ended at deployment. That review should look for suspicious documents, unexpected outbound connections, process chains from Word, and signs that the vulnerability was used to establish a foothold before patching. The Vulnerability Management Guide provides a practical prioritisation lens for KEV-driven remediation, and the CWE Top 25 Guide is useful for understanding how this weakness class fits into broader software weakness patterns.
Risk and Threat Considerations
This flaw is high-risk because it lets an attacker influence a decision the application should make only on trustworthy data. In a widely deployed document editor, that kind of trust failure can become a reliable initial-access path through routine business documents.
Failure mechanism: Word treats attacker-controlled input as a valid basis for a security-relevant decision, so the document can alter how the application evaluates trust, content, or execution paths.
Impact: Successful exploitation can lead to arbitrary code execution, sandbox bypass, or downstream compromise of the user endpoint and any credentials or sessions available on it.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
CIS Controls v8, NIST SP 800-53 Rev 5 and OWASP ASVS set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | CIS-7 — Continuous Vulnerability Management | This CVE requires fast prioritisation, remediation tracking and exposure validation. |
| Recommendation — Prioritise, track and verify remediation for this known exploited vulnerability. | ||
| NIST SP 800-53 Rev 5 | SI-2 — Flaw Remediation | The subject is an exploited software flaw needing prompt corrective action and verification. |
| RA-5 — Vulnerability Monitoring and Scanning | Exposure assessment depends on identifying affected Word installations and attack surface. | |
| Recommendation — Patch or mitigate the flaw, then verify the fix is deployed and effective. Scan and inventory affected endpoints to confirm where Word exposure exists. | ||
| OWASP ASVS | V15 — Secure Coding and Architecture | The weakness is a trust-decision failure in software architecture and input handling. |
| V16 — Security Logging and Error Handling | Detection and post-compromise review rely on meaningful logging around document behavior. | |
| Recommendation — Review trust boundaries so untrusted content cannot drive security decisions. Log suspicious document-driven execution paths and investigate anomalies quickly. | ||
Practitioner Guidance
Why practitioners should care: The key operational mistake is to treat document content as harmless because it is “just a file.” For this class of vulnerability, the file is the delivery mechanism and the decision input, so the remediation priority should reflect endpoint exposure and the business value of the users who open external documents.
What to watch for: Pay special attention to users who routinely open unsolicited or partner-supplied Word files, and to environments where document processing is automated or centralized. Those workflows tend to amplify the reach of a single exploited document.
Related resources from NHI Mgmt Group
- CVE-2026-21509 (Microsoft Office Security Feature Bypass)
- CVE-2026-20131 (Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management Deserialization of Untrusted Data)
- CVE-2023-21715 (Microsoft Office Publisher Security Feature Bypass)
- CVE-2016-7262 (Microsoft Office Security Feature Bypass)