Yes. CISA added CVE-2026-21514 to its Known Exploited Vulnerabilities catalogue on 10 February 2026, which it does only when there is reliable evidence of active exploitation. CISA has not linked it to known ransomware campaigns. Microsoft Office Word contains a reliance on untrusted inputs in a security decision vulnerability that could allow an authorized attacker to elevate privileges locally.
What “exploited in the wild” means for this CVE
For CVE-2026-21514, the practical answer is not just that a flaw exists, but that defenders should treat it as live exposure. CISA only adds vulnerabilities to the KEV catalogue when it has reliable evidence of active exploitation, so this is a strong signal to prioritise action over routine backlog handling.
Because the issue is in Microsoft Office Word and is described as a reliance on untrusted inputs in a security decision, the main concern is not abstract code quality. It is whether Word can be steered into making an unsafe trust decision from attacker-controlled content, which can turn a local document-open event into privilege escalation.
For practitioners, that distinction matters: “exploited in the wild” means you should assume opportunistic targeting, not just theoretical abuse. In practice, that shifts the question from “is it real?” to “where is Word exposed, who can open untrusted files, and how fast can you verify containment?”
How to confirm exposure and reduce risk quickly
Start by identifying where Microsoft Word is installed and whether users commonly open externally sourced documents, especially from email, chat, shared drives or browser downloads. If Word is present on endpoints with elevated local rights, or if privileged users routinely open untrusted files there, the blast radius is larger than on a hardened, least-privilege workstation.
Use the vendor advisory and the CISA KEV entry as the authoritative sources for version scope and remediation steps, rather than relying on secondary summaries. If you are running formal vulnerability triage, treat KEV listing as a prioritisation override, not a normal score-based tie breaker, and place it ahead of lower-confidence findings.
Where patching or mitigation cannot happen immediately, narrow exposure by limiting who can open untrusted Office content, reducing local privilege where possible, and forcing closer review of document sources. If the affected workflow is business critical, isolate it to a constrained endpoint class instead of leaving the same document path available on every workstation.
What to check after remediation
Because the flaw can support local privilege elevation, remediation should not stop at installation verification. Check for signs that the endpoint was used to stage follow-on actions, including unusual new processes, unexpected persistence, modified security settings, suspicious child processes from Word, or privilege changes after document open events.
If there is any chance the vulnerability was already abused, review recent document activity, mailbox delivery traces, download history and endpoint telemetry around the likely exposure window. The goal is to determine whether the exploit was merely blocked or whether it created a foothold that needs broader incident response.
When evidence suggests compromise, treat credential and session review as part of the response if the affected user had access to sensitive internal systems. A local privilege escalation on a trusted workstation can become a launch point for later movement, so the response should extend beyond the application itself.
Risk and Threat Considerations
This vulnerability matters because Word is a high-frequency trust boundary: users routinely open content from outside the organization, and attackers know that document handling often sits close to privileged workflows. Once an exploit can influence a security decision based on untrusted input, the outcome can be controlled privilege gain rather than a simple crash or denial of service.
Failure mechanism: An attacker supplies crafted content that Word processes as trustworthy during a security decision, allowing local privilege escalation on a system where the user or process context provides enough reach to make exploitation useful.
Impact: Successful exploitation can create a stronger foothold on the endpoint, enable follow-on persistence or credential access, and increase the chance that a single document interaction turns into broader compromise.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST CSF 2.0, NIST SP 800-53 Rev 5, CIS Controls v8 and OWASP ASVS set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | ID.RA-01 — Asset Vulnerability Identification | Active exploitation makes exposure triage and asset scoping central. |
| PR.DS-10 — Data in Transit Is Protected | Document delivery channels are the entry path for hostile content. | |
| DE.CM-01 — Networks and Services Are Monitored to Find Anomalies and Events | Post-exploit checks rely on detecting suspicious process and endpoint activity. | |
| Recommendation — Identify affected Word installations and rank them for urgent remediation. Harden document delivery paths and block untrusted inbound file sources. Monitor Word execution chains and privilege anomalies after exposure. | ||
| NIST SP 800-53 Rev 5 | SI-2 — Flaw Remediation | KEV-listed exploitation requires urgent flaw remediation and verification. |
| SI-4 — System Monitoring | Compromise checks depend on endpoint telemetry and suspicious process review. | |
| AC-6 — Least Privilege | Local privilege escalation is materially less dangerous on least-privilege endpoints. | |
| Recommendation — Apply and verify the vendor fix for the affected Word vulnerability. Review endpoint telemetry for Word-triggered suspicious activity. Reduce local admin rights to limit the impact of exploitation. | ||
| CIS Controls v8 | CIS-7 — Continuous Vulnerability Management | KEV and active exploitation make prioritised vulnerability handling essential. |
| CIS-10 — Malware Defenses | Malicious documents often pair exploitation with endpoint payload delivery. | |
| CIS-6 — Access Control Management | Privilege escalation increases risk when local access is overly broad. | |
| Recommendation — Prioritise KEV-listed vulnerabilities for immediate remediation. Use endpoint defenses to block and detect malicious document activity. Restrict elevated local access on systems that process external documents. | ||
| OWASP ASVS | V2 — Validation and Business Logic | The flaw is a trust decision driven by untrusted input. |
| Recommendation — Validate security decisions that depend on external or attacker-controlled input. | ||
Practitioner Guidance
What to prioritise: Put this on the same response track as any other KEV-listed issue with demonstrated exploitation. Prioritise systems where Word is installed for privileged users, high-value business users, or endpoints that regularly handle external documents.
What to verify: Confirm the affected estate, confirm the remediation path from the vendor advisory, and confirm whether endpoint logs show suspicious Word-driven process chains or privilege changes around the exposure window.
Common mistake: Treating this as a standard software update item and stopping at patch deployment. For exploited vulnerabilities, the operational question is also whether compromise already occurred and whether the document workflow itself remains too permissive.
Practitioner takeaway: When CISA places a Word flaw in KEV, the right response is urgent exposure reduction plus compromise checking, because the business risk is not just vulnerable software, but a live path from document content to elevated local control.
Related resources from NHI Mgmt Group
- Guide: Zero-Day and Exploited Vulnerabilities Guide
- How do you patch or mitigate CVE-2026-21514 (Microsoft Office Word Reliance on Untrusted Inputs in a Security Decision)?
- CVE-2026-21514 (Microsoft Office Word Reliance on Untrusted Inputs in a Security Decision)
- Is CVE-2026-21509 (Microsoft Office Security Feature Bypass) being exploited in the wild?
- Is CVE-2026-20131 (Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management Deserialization of Untrusted Data) being exploited in the wild?