Office zero-day exploited, forces Microsoft OOB patch

Updated Microsoft has issued an emergency Office patch after confirming a zero-day flaw is already being used in real world attacks. The flaw, tracked as CVE-2026-21509, and slapped with a CVSS score of 7.8, falls into Microsoft's "security feature bypass" bucket. In practice, this means attackers can dodge protections that are supposed to stop unsafe legacy components from running. Those components include COM and OLE – old Windows plumbing that's been at the heart of document-based attacks for years and clearly hasn't earned its retirement yet. According to Microsoft, exploitation doesn't hinge on the Office preview pane – often a red flag in past campaigns – but still requires little effort once a victim is persuaded to open a booby-trapped file. In its advisory, the company describes the issue as a case of "reliance on untrusted inputs in a security decision," a polite way of saying Office can be talked into doing things it shouldn't. "Reliance on untrusted inputs in a security decision in Microsoft Office allows an unauthorized attacker to bypass a security feature locally," Microsoft said. "An attacker must send a user a malicious Office file and convince them to open it." The flaw hits most current Office builds, from Office 2016 and 2019 through to the LTSC releases and Microsoft 365 Apps for Enterprise. Updates are out for newer versions, but anyone still running Office 2016 or 2019 is stuck waiting. Microsoft says fixes for those editions aren't ready yet and will s...