# Microsoft Office security feature bypass under active exploit

Published: 2026-01-27 · Severity: high · Sectors: government-national, financial-services, healthcare, education, manufacturing, technology, energy, defense
Canonical: https://vorant.io/reports/102f9ab9-8849-5bb3-81d3-a1f86e0a0f68/microsoft-office-security-feature-bypass-under-active-exploit

> CVE-2026-21509 in Microsoft Office allows security feature bypass via malicious files; actively exploited in the wild.

Microsoft has disclosed CVE-2026-21509, a vulnerability in Microsoft Office that permits attackers to bypass security features through specially crafted Office documents. The flaw relies on untrusted input handling in security decision logic and requires social engineering—an attacker must convince a recipient to open a malicious file. Notably, the Preview Pane is not an attack vector, limiting passive exposure. Microsoft reports active exploitation of this vulnerability in the wild, and CISA has added it to its Known Exploited Vulnerabilities catalog, signaling immediate defensive priority.

The vulnerability affects Microsoft Office 2019 (both 32-bit and 64-bit editions prior to 16.0.10417.20095) and Microsoft Office 2016 (both editions prior to 16.0.5539.1001). The attack vector is classified under Initial Access via User Execution, indicating the attack flow begins when a user opens a malicious document. Because active exploitation is confirmed, patching affected Office versions immediately is critical. Defenders should prioritize applying the published updates and implementing email-based controls to restrict potentially malicious Office file delivery.

## Mentioned in this report

- Vulnerabilities: CVE-2026-21509 (KEV)

## Detection guidance (public sample)

### Office Application Spawning Script Interpreter or LOLBin

ATT&CK: T1204.002

Detects Word, Excel, PowerPoint, Outlook or Access spawning a shell, script host or common LOLBin, a typical post-open behaviour after a malicious Office document is opened, including bypass exploits such as CVE-2026-21509. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Office Application Spawning Script Interpreter or LOLBin
description: Detects Office applications spawning shells, script hosts or common LOLBins.
  The CVE-2026-21509 report describes only a malicious document opened by the user,
  so this covers generic post-open execution rather than a specific exploit artefact.
tags:
- attack.execution
- attack.t1204.002
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
    - \WINWORD.EXE
    - \EXCEL.EXE
    - \POWERPNT.EXE
    - \MSACCESS.EXE
    - \OUTLOOK.EXE
  selection_child:
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \wscript.exe
    - \cscript.exe
    - \mshta.exe
    - \rundll32.exe
    - \regsvr32.exe
    - \certutil.exe
    - \bitsadmin.exe
    - \msiexec.exe
  condition: selection_parent and selection_child
falsepositives:
- Legacy macro-enabled business workbooks that call cmd.exe or PowerShell for automation
- Office add-ins that launch rundll32 or msiexec for helper functions
level: medium
id: 58de76ea-7611-5c9f-83b0-1a696e286f5e
status: experimental
author: Vorant
references:
- https://www.cisecurity.org/advisory/a-vulnerability-in-microsoft-office-could-allow-for-security-feature-bypass_2026-007
```

### Office Application Dropping Executable or Script Content in User-Writable Path

ATT&CK: T1204.002

Detects Office processes writing executable or script files to user-writable locations, a common outcome of a malicious document bypassing Office protections. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Office Application Dropping Executable or Script Content in User-Writable Path
description: Detects Office applications creating executable, DLL or script files
  in AppData, Temp, ProgramData or Public paths. This is generic dropper behaviour
  following malicious document execution.
tags:
- attack.execution
- attack.t1204.002
logsource:
  category: file_event
  product: windows
detection:
  selection_image:
    Image|endswith:
    - \WINWORD.EXE
    - \EXCEL.EXE
    - \POWERPNT.EXE
  selection_path:
    TargetFilename|contains:
    - \AppData\
    - \Temp\
    - \ProgramData\
    - \Users\Public\
  selection_ext:
    TargetFilename|endswith:
    - .exe
    - .dll
    - .scr
    - .hta
    - .js
    - .jse
    - .vbs
    - .vbe
    - .ps1
    - .bat
    - .cmd
    - .lnk
  condition: selection_image and selection_path and selection_ext
falsepositives:
- Office add-in installers or updaters writing DLLs into the user profile
- Excel exports of .bat or .cmd files by users in temp folders
level: medium
id: 305d9e40-f050-5e58-80da-1f81f1a5e2d1
status: experimental
author: Vorant
references:
- https://www.cisecurity.org/advisory/a-vulnerability-in-microsoft-office-could-allow-for-security-feature-bypass_2026-007
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisecurity.org/advisory/a-vulnerability-in-microsoft-office-could-allow-for-security-feature-bypass_2026-007

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/102f9ab9-8849-5bb3-81d3-a1f86e0a0f68/microsoft-office-security-feature-bypass-under-active-exploit.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup