Skip to content
brandefense.io
Request A Demo
Vulnerability Intelligence

CVE-2026-21514

HighExploitedPublic exploit

Microsoft Word Security Feature Bypass Vulnerability

Published Feb 10, 2026 · Updated Aug 19, 2026

Key Facts

Patch immediately
  • CVE-2026-21514 is a high-severity vulnerability (CVSS 7.8 v3.1) affecting 365 Apps (Microsoft), Office 2021 (Microsoft), Office 2024 (Microsoft) and 8 more products.
  • It is exploited in the wild, listed in CISA KEV, Industry KEV feed, CIRCL KEV, ENISA EUVD since Feb 10, 2026. Public exploit code is available.
  • EPSS estimates a 1.6% probability of exploitation in the next 30 days.
  • Fixed versions are available, including Microsoft 365 Apps for Enterprise https://aka.ms/OfficeSecurityReleases, Microsoft Office LTSC 2021 https://aka.ms/OfficeSecurityReleases, Microsoft Office LTSC 2024 https://aka.ms/OfficeSecurityReleases.
  • Brandefense priority: patch immediately, because it is listed as exploited in the wild.

CVSS v3.1

7.8

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS (30-day exploit likelihood)

1.6%

Higher than 75.1% of all scored CVEs

Exploited in the wild

Yes

4 catalog listings

Public exploit code

Available

Proof-of-concept or weaponized module

Get the full CVE-2026-21514 brief as a PDF

Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.

Description

Reliance on untrusted inputs in a security decision in Microsoft Office Word allows an unauthorized attacker to bypass a security feature locally.

Known-Exploited Catalog Listings

CatalogAddedRemediation dueRansomware use
CISA KEVFeb 10, 2026Mar 3, 2026Not reported
Industry KEV feedFeb 10, 2026Mar 3, 2026Not reported
CIRCL KEVFeb 10, 2026Mar 3, 2026Not reported
ENISA EUVDFeb 10, 2026n/aNot reported

Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Affected Products

18 affected entries in total
ProductAffected versionsFixed in
365 AppsMicrosoftSee advisoryn/a
Office 2021MicrosoftSee advisoryn/a
Office 2024MicrosoftSee advisoryn/a
Office Long Term Servicing ChannelMicrosoft2021, 2024n/a
Office Macos 2021MicrosoftSee advisory16.106.26020821
6 more affected products in the full CVE brief

Patched Releases

Microsoft 365 Apps for Enterprise

https://aka.ms/OfficeSecurityReleases

Microsoft Office LTSC 2021

https://aka.ms/OfficeSecurityReleases

Microsoft Office LTSC 2024

https://aka.ms/OfficeSecurityReleases

Microsoft Office LTSC for Mac 2021

16.106.26020821

Microsoft Office LTSC for Mac 2024

16.106.26020821

Timeline

  1. Publicly disclosed

    Feb 10, 2026

  2. Added to CISA KEV

    Feb 10, 2026

  3. Added to Industry KEV feed

    Feb 10, 2026

  4. Added to CIRCL KEV

    Feb 10, 2026

  5. Added to ENISA EUVD

    Feb 10, 2026

  6. Last updated

    Aug 19, 2026

Weakness Type

  • CWE-807 Reliance on Untrusted Inputs in a Security Decision

References

2 more references in the full CVE brief

FAQ

Common Questions.

Is CVE-2026-21514 Running On Your Attack Surface?

Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.

Request A Demo