Microsoft issues out-of-band patch for actively exploited Microsoft Office zero-day vulnerability

Microsoft has released an out-of-band security update to address an actively exploited zero-day vulnerability affecting Microsoft Office, adding further pressure to an already turbulent January 2026 update cycle that has also seen serious stability issues on Windows 11 systems.

Tracked as CVE-2026-21509, the vulnerability is classified as a security feature bypass caused by “reliance on untrusted inputs in a security decision in Microsoft Office,” according to the Microsoft Security Response Center. Successful exploitation allows an attacker to locally bypass Office security protections, specifically OLE mitigations designed to block vulnerable COM and OLE controls.

Microsoft has assigned the flaw a CVSS v3.1 score of 7.8 and confirmed that it is being exploited in the wild. While the company has not disclosed technical details about the attacks, it noted that exploitation requires user interaction, with attackers needing to convince victims to open a specially crafted Office file. The Preview Pane is not an attack vector.

Systems running Office 2021 and newer are automatically protected through a service-side change, though users must restart their Office applications for the mitigation to take effect. Customers on Office 2016 and Office 2019, however, are not protected until they install the latest security updates. Microsoft has also provided a registry-based workaround that can be applied immediately on affected systems to block exploitation prior to patching.

The vulnerability has been added to the Known Exploited Vulnerabilities catalog maintained by the Cybersecurity and Infrastructure Security Agency, which is requiring U.S. federal agencies to apply the updates by February 16, 2026.

Earlier this month, Windows 11 security update KB5074109 was linked to widespread stability issues and reports of UNMOUNTABLE_BOOT_VOLUME boot failures on some systems, underscoring the increasingly fragile state of recent Windows and Office updates.