CVE-2026-21509

Name of the Vulnerable Software and Affected Versions Microsoft Office versions 2016 through 2019 Microsoft Office LTSC versions 2021 through 2024 Microsoft 365 Apps (affected versions not specified)

Description Microsoft Office contains a flaw where the application relies on untrusted inputs when making security decisions, allowing an unauthorized attacker to bypass local security features. Specifically, the issue enables the bypass of Object Linking and Embedding (OLE) security mechanisms. An attacker can exploit this by convincing a user to open a specially crafted document (such as RTF files), which can lead to arbitrary code execution on the system without user interaction.

Real-world exploitation has been observed by state-sponsored actors, including APT28 (Fancy Bear) and BO Team. These campaigns have targeted military, government, maritime, and transportation sectors across Europe and Ukraine. Technical exploitation often involves triggering a WebDAV connection upon opening the document to download malicious payloads, such as the EhStoreShell.dll and the NotDoor VBA backdoor. The attack chain frequently utilizes Component Object Model (COM) hijacking and steganography to conceal shellcode within PNG images to deploy implants like the Covenant Grunt and BeardShell backdoor.

Recommendations For Microsoft Office 2016, install security update KB5002713. For Microsoft Office 2019, update to Build 10417.20095. For Microsoft Office LTSC 2021 and 2024, install the February 2026 security update. As a temporary mitigation, restrict the use of the vulnerable OLE component Shell.Explorer.1 by creating a registry key {EAB22AC3-30C1-11CF-A7EB-0000C05BAE0B} under the COM Compatibility node of the appropriate Microsoft Office registry path and setting the Compatibility Flags DWORD value to 400.