Description
Reliance on untrusted inputs in a security decision in Microsoft Office allows an unauthorized attacker to bypass a security feature locally.
CISA Known Exploited Vulnerability
Date added 2026-01-26 | Due date 2026-02-16
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Problem types
CWE-807: Reliance on Untrusted Inputs in a Security Decision
Product status
References
www.cisa.gov/...erabilities-catalog?field_cve=CVE-2026-21509
www.vicarius.io/...ice-security-feature-bypass-vulnerability
www.vicarius.io/...ice-security-feature-bypass-vulnerability
msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21509 (Microsoft Office Security Feature Bypass Vulnerability)