CVE-2026-21509 APT28 Office OLE WebDAV Child Process Execution

Ankit Mehta@Secvyn

•updated Jun 29, 2026•1•0•4

Detects Microsoft Office applications spawning suspicious child processes (e.g., cmd.exe, rundll32.exe) or initiating network connections to WebDAV paths, which may indicate exploitation of ActiveX OLE auto-execution vulnerabilities.