Is CVE-2026-21509 (Microsoft Office Security Feature Bypass) being exploited in the wild?

Yes. CISA added CVE-2026-21509 to its Known Exploited Vulnerabilities catalogue on 26 January 2026, which it does only when there is reliable evidence of active exploitation. CISA has not linked it to known ransomware campaigns. Microsoft Office contains a security feature bypass vulnerability in which reliance on untrusted inputs in a security decision in Microsoft Office could allow an unauthorized attacker to bypass a security feature locally.

How to verify that CVE-2026-21509 is actively exploited

The practical test is not whether the flaw exists, but whether your Office estate is exposed to the same security decision path that the vulnerability affects. Treat CISA KEV listing as a signal that exploitation has moved beyond theory, then confirm where Office is installed, how documents are handled, and whether risky content paths are reachable from user workflows.

For vulnerability triage, anchor your validation in the CISA KEV record and the vendor advisory rather than secondary writeups. The KEV catalogue is the strongest public indicator that the issue is being used in the wild, and Microsoft’s own guidance is the authoritative source for the product-specific security feature bypass mechanics and any required mitigation steps.

Where you need a broader response model, use the same approach you would for other actively exploited vulnerabilities: scope the asset, confirm exposure, and compare the issue against your remediation priority rules. NHIMG’s Zero-Day and Exploited Vulnerabilities Guide is useful here because it ties KEV status, emergency response and post-patch verification into one workflow.

What the bypass means for Microsoft Office security decisions

A security feature bypass means the product is making a trust decision that should have been constrained, and untrusted input can influence that decision. In Office, that usually matters because documents are a common ingress path, and the security boundary is often tied to how content is opened, rendered, or interpreted rather than to a simple network-facing service.

The key operational implication is that exploitation may not look like an obvious crash or malware drop. A bypass can simply remove or weaken a protection layer, which is why you should think in terms of exposure to follow-on abuse, not only visible compromise. That makes document source, user interaction, and adjacent controls such as Protected View, macro restrictions, and endpoint inspection important parts of the assessment.

For defenders managing Microsoft environments, the Microsoft 365 Security Guide is a good companion because it covers the surrounding controls that usually determine whether a feature bypass turns into an incident. The same is true of the Endpoint Hardening Checklist, which helps you verify baseline enforcement, logging and patch state on the machines where Office actually runs.

What to do if patching must wait

If you cannot remediate immediately, reduce the attack surface around Office documents and preserve evidence in case exploitation has already occurred. The most useful short-term actions are to tighten intake from untrusted sources, restrict risky document types or embedded content where your business can tolerate it, and increase monitoring on endpoints that open externally sourced files.

You should also validate whether security features are still being enforced as expected on the affected estate. In practice that means checking for policy drift, alternate document handlers, unsafe file associations, and exceptions that let untrusted content reach users without the expected protections.

Use the Vulnerability Management Guide to structure the exception decision, because it frames emergency prioritisation, exception handling and verification in a way that fits KEV-listed issues. If your estate is Microsoft-centric, the Microsoft 365 Security Guide also helps you choose compensating controls that do not depend on users behaving perfectly.

Risk and Threat Considerations

When a security feature bypass is already being exploited in the wild, the main risk is that trust in normal document handling becomes unsafe before the user sees anything suspicious. Attackers do not need to break every control, only the one security decision that lets malicious content proceed under trusted assumptions.

Failure mechanism: The flaw allows untrusted input to influence a local security decision in Microsoft Office, which can let an attacker bypass a protection layer and create room for follow-on execution, content abuse, or secondary payload delivery.

Impact: Exposure is highest where Office is a routine entry point for external files, because a bypass can convert an ordinary document-open event into a platform for deeper compromise, data exposure, or user-level exploitation.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

NIST CSF 2.0, NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
NIST CSF 2.0	ID.RA-01 — Asset Vulnerability Identification	Identifies exposed Office assets and their vulnerability status.
	DE.CM-08 — Vulnerability Scanning	Supports verifying exposure and detecting vulnerable or unpatched Office hosts.
	RS.MA-01 — Incident Mitigation	Active exploitation requires containment and remediation, not only routine patching.
Recommendation — Inventory Office assets and confirm which endpoints remain exposed to the CVE. Scan endpoints to find Office installations still reachable by the vulnerability. Contain exposed hosts and accelerate remediation when exploitation is suspected.
NIST SP 800-53 Rev 5	RA-5 — Vulnerability Monitoring and Scanning	Directly supports finding and tracking the exposed Office vulnerability across assets.
	SI-2 — Flaw Remediation	The issue requires timely remediation once exploitation is known.
	SI-4 — System Monitoring	Monitoring is needed to detect exploitation attempts and follow-on activity.
Recommendation — Monitor and scan to identify systems still affected by the CVE. Remediate the Office flaw promptly and verify that fixes are effective. Increase monitoring on Office endpoints for signs of exploitation or abuse.
CIS Controls v8	CIS-7 — Continuous Vulnerability Management	KEV-listed exploitation makes prioritised vulnerability management central here.
	CIS-4 — Secure Configuration of Enterprise Assets and Software	Compensating controls depend on hardened Office and endpoint configuration.
Recommendation — Prioritise and track remediation for Office systems exposed to the CVE. Harden Office and endpoint settings that reduce exposure during delayed patching.

Practitioner Guidance

What to verify: Confirm which Office versions, channels, and endpoint groups are actually exposed, then check whether the vulnerable security decision path is reachable from the document workflows your users rely on. If the answer is yes, treat the issue as an exposure problem first and a patching problem second.

Decision rule: If the affected systems handle externally sourced documents, prioritise rapid containment, patching, and follow-up hunting over broad infrastructure changes. If patching is delayed, reduce intake paths and raise monitoring before you spend time on low-probability root-cause hypotheses.

Practitioner takeaway: For KEV-listed Office flaws, the important question is not only “is it patched?”, but “can an attacker still reach the security decision that the bypass undermines?”