CVE-2026-21509

LLM-synthesized narrative grounded in this CVE's description and references.

• Microsoft/365 Apps2 versions

  cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:x64:*+ 1 more

  • cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:x64:*
  • cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:x86:*
• Microsoft/Office7 versions

  cpe:2.3:a:microsoft:office:2016:*:*:*:*:*:x64:*+ 6 more

  • cpe:2.3:a:microsoft:office:2016:*:*:*:*:*:x64:*
  • cpe:2.3:a:microsoft:office:2016:*:*:*:*:*:x86:*
  • cpe:2.3:a:microsoft:office:2019:*:*:*:*:*:x64:*
  • cpe:2.3:a:microsoft:office:2019:*:*:*:*:*:x86:*
  • (no CPE)
  • (no CPE)range: 16.0.1
  • (no CPE)range: 16.0.0
• Microsoft/Office Long Term Servicing Channel4 versions

  cpe:2.3:a:microsoft:office_long_term_servicing_channel:2021:*:*:*:*:-:x64:*+ 3 more

  • cpe:2.3:a:microsoft:office_long_term_servicing_channel:2021:*:*:*:*:-:x64:*
  • cpe:2.3:a:microsoft:office_long_term_servicing_channel:2021:*:*:*:*:-:x86:*
  • cpe:2.3:a:microsoft:office_long_term_servicing_channel:2024:*:*:*:*:-:x64:*
  • cpe:2.3:a:microsoft:office_long_term_servicing_channel:2024:*:*:*:*:-:x86:*
• Microsoft/Microsoft 365 Apps for Enterprisev5

  Range: 16.0.1
• Microsoft/Office Visiocpe-rescue2 versions

  16.0.0+ 1 more

  • (no CPE)range: 16.0.0
  • (no CPE)range: 19.0.0

• msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21509nvdVendor Advisory
• www.vicarius.io/vsociety/posts/cve-2026-21509-detection-script-microsoft-office-security-feature-bypass-vulnerabilitynvdThird Party Advisory
• www.vicarius.io/vsociety/posts/cve-2026-21509-mitigation-script-microsoft-office-security-feature-bypass-vulnerabilitynvdMitigationThird Party Advisory
• www.cisa.gov/known-exploited-vulnerabilities-catalognvdUS Government Resource

• Gamaredon Exploits WinRAR to Deliver GammaWorm and GammaSteel Against Ukraine
  The Hacker News · Jun 2, 2026
• Exploits and vulnerabilities in Q1 2026
  Securelist · May 7, 2026
• Pawn Storm Campaign Deploys PRISMEX, Targets Government and Critical Infrastructure Entities
  Trend Micro Research · Mar 26, 2026
• Sednit reloaded: Back in the trenches
  ESET WeLiveSecurity · Mar 10, 2026