# CVE-2026-21509 - Microsoft Office Security Feature Bypass (CISA KEV)

> CVE-2026-21509 is a Microsoft Office Security Feature Bypass vulnerability actively exploited in the wild and added to the CISA Known Exploited Vulnerabilities (KEV) catalog on January 26, 2026 with a mandatory federal remediation deadline of February 16, 2026. The vulnerability exploits a 'reliance on untrusted inputs in a security decision' flaw in Microsoft Office's OLE (Object Linking and Embedding) security model, allowing an unauthorized attacker to bypass Protected View, Mark-of-the-Web (MOTW), and other Office security features locally. This is the CISA KEV enforcement perspective on the OLE bypass lineage — a 30+ year attack surface that has produced 6 generations of security feature bypass vulnerabilities. Under BOD 22-01, all Federal Civilian Executive Branch (FCEB) agencies must remediate or remove affected systems by the deadline. CISA notes some impacted products are End-of-Life (EoL) or End-of-Service (EoS), advising discontinuation. The CVSS v3.1 base score is 7.8 (HIGH) with local attack vector, low complexity, no privileges required, but requiring user interaction (opening a crafted document). EPSS score of 0.13 (13% probability of exploitation in next 30 days — significantly elevated). Affected products span the entire Microsoft Office ecosystem: Office 2016, Office 2019, Office LTSC 2021, Office LTSC 2024, and Microsoft 365 Apps for Enterprise. The vulnerability is classified as CWE-807 (Reliance on Untrusted Inputs in a Security Decision) — Office trusts document metadata/properties that an attacker can manipulate to bypass security checks. Active exploitation confirmed by CISA but ransomware campaign usage unknown at this time. This threat represents the federal compliance enforcement dimension of the OLE eternal attack surface.

- **Published:** 2026-02-02T20:55:00Z
- **Last reviewed:** 2026-02-02T20:55:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0021
- **ID:** TL-2026-0021
- **Severity:** HIGH (CVSS 7.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Actor:** APT28 (Russia)
- **Detections:** 16 · **IOCs:** 47 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-21509

## Description

CVE-2026-21509 exploits a fundamental design flaw in Microsoft Office's security decision framework: the OLE subsystem relies on untrusted inputs (document metadata, zone identifiers, embedded object properties) to make security decisions about whether to enable Protected View, apply MOTW restrictions, or allow macro execution. An attacker crafts a malicious Office document that manipulates these trusted-but-manipulable inputs to bypass security features that should prevent code execution from untrusted documents.

The attack chain: (1) Attacker crafts a malicious Office document (Word, Excel, PowerPoint) with manipulated OLE properties/metadata that trick Office's security decision engine, (2) Document is delivered via spearphishing email, web download, or file share, (3) Victim opens the document — because security inputs are manipulated, Office does NOT apply Protected View or MOTW restrictions, (4) Document opens in full editing mode with active content enabled, bypassing the security dialog that normally warns users, (5) Embedded macros, OLE objects, or active content execute without user approval, achieving arbitrary code execution.

CISA KEV Enforcement Context: Under Binding Operational Directive (BOD) 22-01, issued November 3, 2021, all Federal Civilian Executive Branch (FCEB) agencies are compelled to remediate KEV catalog vulnerabilities within CISA's specified timeline. CVE-2026-21509 was added January 26, 2026 with a 21-day remediation window (due February 16, 2026). This is a mandatory, legally binding requirement — not a recommendation. Agencies that cannot patch must remove affected assets from their network. CISA does not issue waivers or exceptions.

BOD 22-01 Key Requirements: (1) Federal agencies must review and update internal vulnerability management procedures within 60 days, (2) Remediate each KEV vulnerability within the CISA-specified timeframe, (3) Report status of remediation to CISA, (4) If patching is impossible, remove the asset from the network — isolation is an acceptable form of removal, (5) For third-party hosted systems, agencies must contact service providers for compliance status.

The OLE Lineage (6 Generations of Bypass): This vulnerability is the latest in a persistent lineage of OLE-related security feature bypasses in Microsoft Office spanning 30+ years: Gen 1 (OLE1, 1990s) — original Object Linking and Embedding with no security model, Gen 2 (OLE2/COM, 2000s) — macro viruses exploited unlimited OLE capabilities, Gen 3 (Protected View era, 2010s) — Microsoft added sandboxing but OLE objects could escape, Gen 4 (MOTW era, mid-2010s) — Mark-of-the-Web added zone identifiers but OLE manipulation bypassed them, Gen 5 (recent CVEs) — repeated bypasses of Protected View via OLE property manipulation, Gen 6 (CVE-2026-21509) — current KEV-listed active exploitation of untrusted input reliance in security decisions.

Critical Infrastructure Impact: Microsoft Office is deployed across virtually every federal agency, defense contractor, critical infrastructure operator, and enterprise worldwide. The February 16 deadline creates acute pressure on organizations with large, complex Office deployments. End-of-Life versions (Office 2016) are explicitly called out by CISA — agencies running EoL Office must discontinue use entirely, not just patch. This is a forcing function for Office modernization across the federal enterprise.

The paradox: Office's security features (Protected View, MOTW, macro blocking) are supposed to protect users from malicious documents. CVE-2026-21509 bypasses ALL of them by manipulating the inputs Office uses to decide whether to apply those protections. The security decision itself is the vulnerability.

## MITRE ATT&CK

- T1553 Subvert Trust Controls
- T1566.001 Spearphishing Attachment
- T1204.002 Malicious File
- T1566 Phishing
- T1204 User Execution
- T1059 Command and Scripting Interpreter
- T1559 Inter-Process Communication
- T1137 Office Application Startup
- T1036 Masquerading
- T1027 Obfuscated Files or Information
- T1218 System Binary Proxy Execution
- T1112 Modify Registry
- T1056 Input Capture
- T1082 System Information Discovery
- T1083 File and Directory Discovery
- T1005 Data from Local System
- T1071 Application Layer Protocol
- T1041 Exfiltration Over C2 Channel
- T1199 Trusted Relationship
- T1203 Exploitation for Client Execution
- T1070 Indicator Removal
- T1003 OS Credential Dumping
- T1534 Internal Spearphishing
- T1486 Data Encrypted for Impact
- T1587 Develop Capabilities
- T1591 Gather Victim Org Information

## Sources

- [CISA KEV Catalog Entry](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
- [Microsoft Security Response Center](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21509)
- [CISA KEV Catalog — CVE-2026-21509](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-21509)
- [NVD — CVE-2026-21509](https://nvd.nist.gov/vuln/detail/CVE-2026-21509)
- [CISA BOD 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities](https://www.cisa.gov/news-events/directives/bod-22-01-reducing-significant-risk-known-exploited-vulnerabilities)
- [Tenable — CVE-2026-21509 Vulnerability of Interest](https://www.tenable.com/cve/CVE-2026-21509)
- [AttackerKB — CVE-2026-21509](https://attackerkb.com/topics/CVE-2026-21509)
- [Vicarius — CVE-2026-21509 Detection Script](https://www.vicarius.io/vsociety/posts/cve-2026-21509-detection-script-microsoft-office-security-feature-bypass-vulnerability)
- [Vicarius — CVE-2026-21509 Mitigation Script](https://www.vicarius.io/vsociety/posts/cve-2026-21509-mitigation-script-microsoft-office-security-feature-bypass-vulnerability)
- [CISA KEV Full Catalog (JSON Feed)](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json)
- [CISA KEV Full Catalog (CSV)](https://www.cisa.gov/sites/default/files/csv/known_exploited_vulnerabilities.csv)
- [CVE-2026-21514 — Microsoft Office Word Untrusted Input (Same Patch Tuesday)](https://www.cve.org/CVERecord?id=CVE-2026-21514)
- [CVE-2026-21510 — Microsoft Windows Shell Protection Mechanism Failure (Sibling KEV)](https://www.cve.org/CVERecord?id=CVE-2026-21510)
- [Microsoft OLE Documentation — Component Object Model](https://learn.microsoft.com/en-us/windows/win32/com/component-object-model--com--portal)
- [MITRE ATT&CK — Phishing: Spearphishing Attachment (T1566.001)](https://attack.mitre.org/techniques/T1566/001/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0021