Microsoft Office Security Feature Bypass Vulnerability
CVE-2026-21509 is a security vulnerability in Microsoft Office, added to CISA KEV on January 26, 2026. Patch order: third of four.
What is CVE-2026-21509?
Microsoft Office contains a security feature bypass vulnerability in which reliance on untrusted inputs in a security decision in Microsoft Office could allow an unauthorized attacker to bypass a security feature locally. Some of the impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version.
Who is affected by CVE-2026-21509?
Affects anyone using Microsoft 365 or Office to compose, store, or send email, documents, or spreadsheets. In a small practice, that's typically where client communications, engagement letters, and case notes live — credential compromise here means an attacker reads everything that platform stores.
What should I do about CVE-2026-21509?
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
The action above is CISA's wording. The directive it names, BOD 22-01, was revoked by BOD 26-04 on June 10, 2026; CISA's catalog still carries the older text for this entry.
If you don't have someone in-house to verify the patch deployed across every endpoint — or you're not sure whether you're affected — that's exactly the kind of triage we do. Request a free review.
Insurance readiness
Your insurer will ask if this is patched.
Unpatched entries on CISA's Known Exploited Vulnerabilities list are exactly what cyber-insurance carrier questionnaires probe for, and knowing which controls they check is how you keep a renewal from stalling.
Get the free carrier questionnaire →Severity
CVSS base score: 7.8 — HIGH
Weakness classification: CWE-807
Microsoft fix
- Click to Run (Security Update)
- KB5002713 (Security Update)
Microsoft Exploitability Index (assessed at update release): Exploitation Detected
Microsoft has confirmed in-the-wild exploitation in the latest software release. This aligns with CISA's listing of this CVE.
Vendor workaround
Vendor-published mitigation
Mitigation refers to a setting, common configuration, or general best-practice, existing in a default state, that could reduce the severity of exploitation of a vulnerability.
The following mitigating factors might be helpful in your situation:
Customers running Microsoft 365 Apps, Office 2021 and later will be automatically protected via a service-side change, but will be required to restart their Office applications for this to take effect.
Customers running Office 2016 and 2019 are not protected until they install the security update. Customers on these versions can apply the registry keys described as follows to be immediately protected.
Microsoft Office:
- To start blocking please add the following registry keys:
Caution: Follow these steps carefully. Serious problems may occur if you modify the registry incorrectly. Before you start we recommend that you have a known good backup of your registry. See this article for more information: https://support.microsoft.com/en-us/help/322756/how-to-back-up-and-restore-the-registry-in-windows
Exit all Microsoft Office applications. Start the Registry Editor by tapping Start (or pressing the Windows key on your keyboard) then typing regedit and pressing enter.
- Locate the proper registry subkey. It will be one of the following:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\16.0\Common\COM Compatibility\ (for 64-bit MSI Office, or 32-bit MSI Office on 32-bit Windows)
or
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Office\16.0\Common\COM Compatibility\ (for 32-bit MSI Office on 64-bit Windows)
or
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Microsoft\Office\16.0\Common\COM Compatibility\ (for 64-bit Click2Run Office, or 32-bit Click2Run Office on 32-bit Windows)
or
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Office\16.0\Common\COM Compatibility\ (for 32-bit Click2Run Office on 64-bit Windows)
Note: The COM Compatibility node may not be present by default. If you don't see it, add it by right-clicking the Common node and choosing Add Key.
- Add a new subkey named {EAB22AC3-30C1-11CF-A7EB-0000C05BAE0B} by right-clicking the COM Compatibility node and choosing Add Key.
Within that new subkey we're going to add one new value by right-clicking the new subkey and choosing New > DWORD (32-bit) Value.
A REG_DWORD hexadecimal value called Compatibility Flags with a value of 400.
Exit Registry Editor and start your Office application.
Example
For example, in Office 2016, 64-bit, on Windows you would locate this registry key:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\16.0\Common\COM Compatibility\
Note: Remember, if the COM Compatibility node doesn't exist yet you'll need to create it.
Then add a subkey with the name {EAB22AC3-30C1-11CF-A7EB-0000C05BAE0B}.
In this case, the resulting path is HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\16.0\Common\COM Compatibility\{EAB22AC3-30C1-11CF-A7EB-0000C05BAE0B}.
To that subkey you'll add a REG_DWORD value called Compatibility Flags with a value of 400.
Vendor-published mitigation
Mitigation refers to a setting, common configuration, or general best-practice, existing in a default state, that could reduce the severity of exploitation of a vulnerability.
The following mitigating factors might be helpful in your situation:
Customers on Office 2021 and later are automatically protected without registry change. Registry keys do not apply to Office 2016 or Office 2019. Customers using Office 2016 or Office 2019 will not be protected until they install the upcoming security update.
A workaround reduces exposure while you patch — it is not a substitute for the update. Install the fix above as soon as you can.
CISA due date
CISA's listed due date: February 16, 2026.
Federal civilian agencies work under CISA's Binding Operational Directive 26-04, which replaced BOD 22-01 on June 10, 2026. It sets the deadline for each affected system by:
- How exposed that system is to the internet
- Whether the attack can be automated
- How much control it gives an attacker
Its table gives catalogued vulnerabilities 3 or 14 days.
None of this binds a private business, but treat the date as a strong recommendation, especially if you handle regulated data (HIPAA, GLBA, ABA model rules).
EPSS
EPSS score: 70.8% — higher than 99% of all scored CVEs.
EPSS estimates the probability of exploitation activity in the next 30 days. Every entry on this site is already confirmed exploited, so read it as relative urgency among the things you still have open, not as permission to wait.
Other exploited Microsoft Office entries
More CISA KEV entries for Microsoft Office. Same product line, same actively-exploited status.
Source
This entry comes from CISA's Known Exploited Vulnerabilities catalog, public US-Government data we pull daily. The plain-language framing and the what-to-do guidance above are ours. View the original entry on cisa.gov.