CVE-2026-21509 - Microsoft Office Security Feature Bypass Vulnerability

Microsoft has released emergency out-of-band security updates to patch a high-severity Microsoft Office zero-day vulnerability exploited in attacks.

The security feature bypass vulnerability, tracked as CVE-2026-21509, affects multiple Office versions, including Microsoft Office 2016, Microsoft Office 2019, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, and Microsoft 365 Apps for Enterprise (the company's cloud-based subscription service).

For Office 2021 and later versions, this update is applied on the service side, and users only need to restart their Office applications. 

For Office 2016 and 2019, manual updating is required.