[VL] - Microsoft Office Security Feature Bypass Vulnerability CVE-2026-21509
Microsoft disclosed CVE-2026-21509 an important vulnerability that allows attackers to bypass Office security protections when a user opens a malicious document (🔗 in the comments). Exploitation has already been observed in the wild. This mainly affects Office 2016 and 2019, which are still widely used. ✅ How to reduce the risk: - Install the January 2026 security updates for Office 2016 / 2019 - If patching is delayed, apply the recommended registry mitigation to block the vulnerable COM/OLE control. (Microsoft 365 Apps and newer Office versions are protected via service-side mitigations (restart required) Even “non-critical” Office vulnerabilities matter — a single document can be enough to trigger an attack. 🚨Execute the following KQL query to detect the affected Version
Microsoft Sentinel (KQL)
