• Microsoft releases update to address zero-day vulnerability in Microsoft Office Microsoft has published three out-of-band (OOB) updates so far in January 2026. • One of these updates was released to address a vulnerability,CVE-2026-21509, affecting Microsoft Office that has been reportedly exploited in the wild. • Additional OOB updates have been published to resolve operational issues experienced following installation of the updatesreleasedas part of the standard Microsoft Patch Tuesday process. • CVE-2026-21509was published to address a security feature bypass vulnerability affecting Microsoft Office. • This vulnerability was rated as “Important” and received a CVSS 3.1 score of 7.8. • This vulnerability is considered “local,” meaning that it must be triggered by an attacker with access to an affected system, or by convincing a victim to open a malicious Office document that triggers the vulnerability.

Article Summaries:

  • Microsoft issued three out‑of‑band updates in January 2026 to patch CVE‑2026‑21509, a local security‑feature bypass vulnerability in Microsoft Office that has been exploited in the wild. The flaw, rated “Important” with a CVSS 3.1 score of 7.8, was added to the CISA Known Exploited Vulnerabilities list. Microsoft also released mitigation guidance and additional updates to address operational issues from the standard Patch Tuesday releases. Security vendors responded with new SNORT rules (65823‑65830 for Snort 2, 301384‑301387 for Snort 3) and a ClamAV signature (Rtf.Exploit.CVE_2026_21509‑10059214‑0) to detect exploitation attempts.

Sources: