Emergency Microsoft Office Update Patches Actively Exploited CVE-2026-21509 OLE Security Bypass

Microsoft released out-of-band (OOB) security updates to address an actively exploited Microsoft Office zero-day, CVE-2026-21509, described as a security feature bypass caused by reliance on untrusted input in a security decision. The flaw impacts Office 2016, Office 2019, Office LTSC 2021, Office LTSC 2024, and Microsoft 365 Apps for Enterprise, and is exploited by sending a user a malicious Office document and convincing them to open it; Microsoft stated the Preview Pane is not an attack vector. The fix addresses a bypass of OLE mitigations intended to protect users from vulnerable COM/OLE controls, but Microsoft did not provide public technical details on the in-the-wild exploitation.

For Office 2021 and later / Microsoft 365 Apps, Microsoft indicated protections may be applied via a service-side fix after restarting Office apps, while Office 2016 and 2019 updates were not yet available at the time of reporting and were promised “as soon as possible.” As interim risk reduction, Microsoft provided mitigations that include a Windows Registry change to block vulnerable COM/OLE controls by adding a COM compatibility key and setting a Compatibility Flags DWORD value; guidance emphasized backing up the registry and restarting Office applications after applying the mitigation.