# Microsoft Office Zero-Day CVE-2026-21509: OLE Security Bypass Under Active Exploitation

> CVE-2026-21509 is a high-severity (CVSS 7.8) security feature bypass vulnerability in Microsoft Office that is under active exploitation in the wild. The vulnerability exists in how Microsoft Office handles OLE (Object Linking and Embedding) objects — specifically, a flaw where reliance on untrusted inputs in a security decision allows an attacker to bypass OLE security checks that normally prevent embedded objects from executing malicious content. When a victim opens a specially crafted Office document (Word, Excel, PowerPoint, or Outlook attachment), the embedded OLE object bypasses Protected View, Mark-of-the-Web (MOTW) propagation, and OLE activation prompts, enabling code execution in the context of the current user without the expected security warnings. Added to CISA KEV on January 26, 2026 with a remediation deadline of February 16, 2026. Affects Microsoft Office 2016, Office 2019, Office LTSC 2021, Office LTSC 2024, and Microsoft 365 Apps for Enterprise. Some affected products may be end-of-life (EoL). Patched in Microsoft's January 2026 Patch Tuesday release.

- **Published:** 2026-02-02T18:22:00Z
- **Last reviewed:** 2026-02-02T18:22:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0010
- **ID:** TL-2026-0010
- **Severity:** HIGH (CVSS 7.8)
- **Category:** VULNERABILITY
- **Status:** MONITORING
- **Detections:** 31 · **IOCs:** 64 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-21509

## Description

CVE-2026-21509 exploits a fundamental weakness in how Microsoft Office evaluates trust decisions for embedded OLE objects. OLE (Object Linking and Embedding) is a decades-old Microsoft technology that allows documents to contain embedded objects from other applications — an Excel spreadsheet inside a Word document, a PowerPoint slide inside an email, or more dangerously, executable content like scripts, ActiveX controls, or linked files.

Microsoft Office implements multiple security layers to protect users from malicious OLE objects: Protected View (read-only sandbox for files from untrusted sources), Mark-of-the-Web (MOTW — Zone.Identifier alternate data stream marking files downloaded from the internet), OLE activation prompts (user confirmation before executing embedded objects), and macro security policies. CVE-2026-21509 bypasses one or more of these security layers by exploiting a flaw where the security decision relies on untrusted input — specifically, metadata or properties within the OLE object itself that the attacker controls.

**Attack Vector:** The attack requires user interaction — the victim must open a specially crafted Office document. The document is typically delivered via spearphishing email attachment, download link, file share, or collaboration platform. Once opened, the malicious OLE object exploits the security feature bypass to execute without triggering the expected security prompts. The attack is local (AV:L) — the attacker does not need network access to the target, but needs the victim to open the document.

**Impact:** With CVSS 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), successful exploitation grants the attacker code execution in the context of the current user. Since most enterprise users run with standard user privileges but have access to sensitive data, documents, email, and internal network resources, this effectively provides: access to all files the user can read/write, ability to install malware or establish persistence, credential harvesting from memory or cached credentials, lateral movement to internal resources, and data exfiltration.

**Historical Context:** OLE security bypasses are a recurring pattern in Microsoft Office exploitation. Notable predecessors include: CVE-2021-40444 (MSHTML OLE object loading remote HTML/ActiveX), CVE-2022-30190 (Follina — ms-msdt: protocol handler via OLE), CVE-2023-36884 (Office HTML RCE via MOTW bypass), CVE-2024-21413 (Outlook OLE preview bypass via file:// protocol), and CVE-2024-38200 (Office NTLM credential leak via OLE). Each generation finds new ways to bypass the security layers Microsoft adds. CVE-2026-21509 continues this pattern.

**Active Exploitation:** CISA added CVE-2026-21509 to the Known Exploited Vulnerabilities (KEV) catalog on January 26, 2026, confirming active exploitation in the wild. The BOD 22-01 remediation deadline is February 16, 2026. While specific campaign details have not been publicly attributed, the CISA KEV listing and Tenable's 'Vulnerability of Interest' classification confirm this is not theoretical. The EPSS score of 0.13006 (top ~13% of all CVEs) indicates meaningful exploitation probability.

**Affected Products:** Microsoft Office 2016, Office 2019, Office LTSC 2021, Office LTSC 2024, and Microsoft 365 Apps for Enterprise. CISA notes some affected products may be end-of-life — Office 2016 mainstream support ended in 2020 and extended support ended in 2025. Organizations still running Office 2016 are advised to discontinue use.

**Patch:** Microsoft released a security update as part of the January 2026 Patch Tuesday (January 26, 2026). The patch addresses the untrusted input validation in OLE object security decisions. Organizations should apply the update immediately given active exploitation and the CISA KEV deadline.

## MITRE ATT&CK

- T1566 Phishing
- T1204 User Execution
- T1059 Command and Scripting Interpreter
- T1203 Exploitation for Client Execution
- T1559 Inter-Process Communication
- T1553 Subvert Trust Controls
- T1218 System Binary Proxy Execution
- T1221 Template Injection
- T1137 Office Application Startup
- T1071 Application Layer Protocol
- T1005 Data from Local System
- T1027 Obfuscated Files or Information
- T1036 Masquerading
- T1187 Forced Authentication
- T1082 System Information Discovery
- T1083 File and Directory Discovery
- T1114 Email Collection
- T1105 Ingress Tool Transfer
- T1041 Exfiltration Over C2 Channel
- T1587 Develop Capabilities
- T1608 Stage Capabilities
- T1140 Deobfuscate/Decode Files or Information
- T1106 Native API
- T1195 Supply Chain Compromise
- T1112 Modify Registry
- T1003 OS Credential Dumping
- T1534 Internal Spearphishing
- T1046 Network Service Discovery
- T1087 Account Discovery
- T1074 Data Staged
- T1567 Exfiltration Over Web Service

## Sources

- [MSRC — CVE-2026-21509 Security Update Guide](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21509)
- [NVD — CVE-2026-21509](https://nvd.nist.gov/vuln/detail/CVE-2026-21509)
- [CISA KEV — CVE-2026-21509](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-21509)
- [Vicarius — CVE-2026-21509 Detection Script](https://www.vicarius.io/vsociety/posts/cve-2026-21509-detection-script-microsoft-office-security-feature-bypass-vulnerability)
- [Vicarius — CVE-2026-21509 Mitigation Script](https://www.vicarius.io/vsociety/posts/cve-2026-21509-mitigation-script-microsoft-office-security-feature-bypass-vulnerability)
- [CVE Record — CVE-2026-21509](https://www.cve.org/CVERecord?id=CVE-2026-21509)
- [Tenable — Microsoft Patch Tuesday Coverage (January 2026 context)](https://www.tenable.com/blog/microsoft-patch-tuesday-january-2026)
- [Tenable: CVE-2026-21509 — CVSS 7.8, EPSS 0.13, Vulnerability of Interest](https://www.tenable.com/cve/CVE-2026-21509)
- [AttackerKB: CVE-2026-21509 — Affected Products and Exploitability Assessment](https://attackerkb.com/topics/CVE-2026-21509)
- [Microsoft Security Response Center: January 2026 Security Updates](https://msrc.microsoft.com/update-guide/releaseNote/2026-Jan)
- [Microsoft: OLE Object Security in Office Documents — Technical Reference](https://learn.microsoft.com/en-us/deployoffice/security/internet-macros-blocked)
- [CISA BOD 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities](https://www.cisa.gov/binding-operational-directive-22-01)
- [Microsoft: Mark of the Web and Protected View in Office](https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/macro-malware)
- [MITRE ATT&CK: Phishing: Spearphishing Attachment (T1566.001)](https://attack.mitre.org/techniques/T1566/001/)
- [CVE-2021-40444: MSHTML OLE Object Remote Code Execution (Historical Precedent)](https://nvd.nist.gov/vuln/detail/CVE-2021-40444)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0010