Microsoft Issues Emergency Patches for Office Zero-Day Vulnerability

On January 26, 2026, Microsoft released emergency out-of-band security patches to address a high-severity zero-day vulnerability in Microsoft Office, tracked as CVE-2026-21509. This vulnerability, which has a CVSS score of 7.8 out of 10, is classified as a security feature bypass, allowing unauthorized attackers to circumvent security measures in Microsoft Office applications. The flaw affects multiple versions, including Microsoft Office 2016, 2019, 2021 LTSC, 2024 LTSC, and Microsoft 365 Apps for Enterprise.

High-risk Office security flaw: Microsoft issues emergency updatesEmergency Microsoft update fixes in-the-wild Office zero-dayMicrosoft Office Zero-Day (CVE-2026-21509) - Emergency Patch Issued for Active ExploitationOffice zero-day exploited, forces Microsoft OOB patch

The vulnerability is exploited by sending a specially crafted Office file to a user, who must then be convinced to open it. Microsoft confirmed that the Office Preview Pane is not an attack vector. However, the company has not disclosed specific details about the nature or scope of the attacks leveraging this vulnerability. The Microsoft Threat Intelligence Center, Microsoft Security Response Center, and Office Product Group Security Team were credited with discovering the issue.

Microsoft Office Zero-Day (CVE-2026-21509) - Emergency Patch Issued for Active ExploitationOffice zero-day exploited, forces Microsoft OOB patchEmergency Microsoft update fixes in-the-wild Office zero-dayHigh-risk Office security flaw: Microsoft issues emergency updates

For users running Office 2021 and later, the protection is automatically applied through a service-side change, requiring a restart of the Office applications. Users of Office 2016 and 2019 must install specific updates or manually modify the Windows Registry to mitigate the risk. The required updates for Office 2016 and 2019 include:

Emergency Microsoft update fixes in-the-wild Office zero-day

• Microsoft Office 2019 (32-bit edition) - 16.0.10417.20095

Microsoft Office Zero-Day (CVE-2026-21509) - Emergency Patch Issued for Active Exploitation

• Microsoft Office 2019 (64-bit edition) - 16.0.10417.20095

Microsoft Office Zero-Day (CVE-2026-21509) - Emergency Patch Issued for Active Exploitation

• Microsoft Office 2016 (32-bit edition) - 16.0.5539.1001

Microsoft Office Zero-Day (CVE-2026-21509) - Emergency Patch Issued for Active Exploitation

• Microsoft Office 2016 (64-bit edition) - 16.0.5539.1001

Microsoft Office Zero-Day (CVE-2026-21509) - Emergency Patch Issued for Active Exploitation

The manual mitigation involves backing up the Registry and adding a specific COM Compatibility registry key with a Compatibility Flags DWORD value.

Office zero-day exploited, forces Microsoft OOB patch

Microsoft's advisory states, "Reliance on untrusted inputs in a security decision in Microsoft Office allows an unauthorized attacker to bypass a security feature locally." The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-21509 to its Known Exploited Vulnerabilities catalog, mandating Federal Civilian Executive Branch agencies to apply the patches by February 16, 2026.

Microsoft Office Zero-Day (CVE-2026-21509) - Emergency Patch Issued for Active ExploitationOffice zero-day exploited, forces Microsoft OOB patchEmergency Microsoft update fixes in-the-wild Office zero-dayHigh-risk Office security flaw: Microsoft issues emergency updates

While Microsoft has taken steps to address the vulnerability, some experts have raised concerns about the reliance on users to apply manual updates and registry changes, which may not be consistently implemented across organizations. The complexity of these mitigations could pose challenges for many users, particularly in larger enterprises.

Office zero-day exploited, forces Microsoft OOB patch

There is currently a lack of detailed information regarding the specific attack methods being used to exploit CVE-2026-21509. Microsoft has not provided insights into the profiles of potential victims or the impact of successful attacks, leaving a gap in understanding the full scope of the threat.

High-risk Office security flaw: Microsoft issues emergency updates

• “An attacker must send a user a malicious Office file and convince them to open it.” — Microsoft Advisory

Emergency Microsoft update fixes in-the-wild Office zero-day

• “This update addresses a vulnerability that bypasses OLE mitigations in Microsoft 365 and Microsoft Office, which protect users from vulnerable COM/OLE controls.” — Microsoft Advisory

Microsoft Office Zero-Day (CVE-2026-21509) - Emergency Patch Issued for Active Exploitation

The urgency of these patches highlights the ongoing risks associated with vulnerabilities in widely used software, emphasizing the need for prompt user action to maintain security.

High-risk Office security flaw: Microsoft issues emergency updates