CVE-2026-21509

Name of the Vulnerable Software and Affected Versions Microsoft Office versions 2016 through 2019 Microsoft Office LTSC versions 2021 through 2024 Microsoft 365 Apps (affected versions not specified)

Description Microsoft Office contains a flaw where the application relies on untrusted inputs when making security decisions, allowing an unauthorized attacker to bypass local security features. Specifically, the issue enables the bypass of Object Linking and Embedding (OLE) security mechanisms. An attacker can exploit this by convincing a user to open a specially crafted document (such as RTF, .xls, or .docm files), which can lead to arbitrary code execution on the system.

Real-world exploitation has been observed in campaigns by APT28 (Fancy Bear), including Operation Neusploit and the PRISMEX suite. These attacks target military, government, maritime, and transportation sectors across Europe, particularly in Ukraine, Romania, and Slovakia. The exploitation chain often involves triggering a WebDAV connection to download malicious payloads, such as the "NotDoor" VBA backdoor, "BeardShell" implant, and "PixyNetLoader," which uses steganography to hide shellcode within PNG images. The attacks frequently leverage legitimate cloud services like Filen and Dropbox for command-and-control (C2) communication to evade detection.

Recommendations For Microsoft Office 2016, install security update KB5002713. For Microsoft Office 2019, update to Build 10417.20095. For Microsoft Office LTSC 2021 and 2024, install the February 2026 security update. As a temporary mitigation for all affected versions, create a new registry subkey {EAB22AC3-30C1-11CF-A7EB-0000C05BAE0B} under the COM Compatibility node of the appropriate Office registry path and add a REG DWORD value named Compatibility Flags set to 400.