← Back to browse · API

CVE-2026-21509

Severity
HIGH
CVSS
7.8
EPSS
0.72152
Risk score
81.45
CISA KEV
Yes
PoC
Yes
Published
2026-01-26
Modified
2026-07-30
First seen
2026-08-06
Aliases
CNVD-2026-16161, EUVD-2026-4666, GHSA-CH84-H92G-MW93
Products
Microsoft 365 Apps for Enterprise, Microsoft Microsoft Office LTSC 2024, Microsoft Office 2016, Microsoft Office 2019, Microsoft Office LTSC 2021, Microsoft Office LTSC for Mac 2021, Microsoft Office LTSC for Mac 2024, Microsoft Office for Android, Microsoft:Microsoft 365 Apps for Enterprise 16.0.1 <https://aka.ms/OfficeSecurityReleases, Microsoft:Microsoft Office 2016 16.0.0 <16.0.5539.1001, Microsoft:Microsoft Office 2019 19.0.0 <16.0.10417.20095, Microsoft:Microsoft Office LTSC 2021 16.0.1 <https://aka.ms/OfficeSecurityReleases, Microsoft:Microsoft Office LTSC 2024 16.0.0 <https://aka.ms/OfficeSecurityReleases, Microsoft:Office
Sources
cnvd CNVD-2026-16161
cisa.gov CVE-2026-21509
packetstorm e1b15243aca2ad53b47ce4cf|CVE-2026-21509
euvd EUVD-2026-4666

Description

Reliance on untrusted inputs in a security decision in Microsoft Office allows an unauthorized attacker to bypass a security feature locally.

References