Skip to content
skopnix
Dossier · Vulnerability

Actively exploited · CISA KEV · NVD published 2026-01-26

CVE-2026-21509

Reliance on untrusted inputs in a security decision in Microsoft Office allows an unauthorized attacker to bypass a security feature locally.

  1. KEV
  2. 2 days →First PoC
  3. 6 days →First cited attacker

Signals

Exploited in the wild
Yesadded 2026-01-26 · due 2026-02-16. An observation, not a forecast.
EPSS · 30-day forecast
71%Chance of exploitation in the next 30 days, 99th percentile of all CVEs. A forecast; KEV outranks it.
CVSS · NVD · HIGH
7.8CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Internet exposure
not stated by sourcesNo exposure census on this CVE's dispatches.

Exploits

13 known · links only

GitHub PoCs · by trust, then stars13

  1. gavz/CVE-2026-21509-PoC ↗Trust ok 100

    Educational PoC for CVE‑2026‑21509 (Microsoft Office security feature bypass). Generates a harmless DOCX with dummy OLE artifacts to study EDR/AV visibility. Not an exploit. For isolated labs only; see README for 7‑Zip inspection steps and mitigation references.

    ★ 20 · created 2026-01-29

  2. kimstars/Ashwesker-CVE-2026-21509 ↗Trust ok 100

    CVE-2026-21509

    ★ 12 · created 2026-01-27

  3. suuhm/CVE-2026-21509-handler ↗Trust ok 100

    PowerShell script to check, apply, and test the Kill-Bit protection for the CVE-2026-21509 Microsoft Office zero-day vulnerability affecting Office 2016/2019/LTSC.

    ★ 8 · created 2026-03-01

  4. decalage2/detect_CVE-2026-21509 ↗Trust ok 100

    YARA rule and python script to detect potential exploits for the CVE-2026-21509 vulnerability in MS Office

    ★ 3 · created 2026-02-04

  5. SimoesCTT/CTT-MICROSOFT-OFFICE-OLE-MANIFOLD-BYPASS-CVE-2026-21509 ↗Trust ok 100

    CVE-2026-21509 is a critical bypass in the Microsoft Office OLE (Object Linking and Embedding) validation engine. While standard "laminar" exploits attempt to manipulate static COM objects, this repository utilizes Theorem 4.2 to achieve a speculative race-condition bypass of the Object Definition Rule (ODR).

    ★ 3 · created 2026-02-01

  6. SimoesCTT/CTT-NFS-Vortex-RCE ↗Trust ok 100

    New Physics Disclosure This repository contains a full weaponized exploit for **CVE-2026-21509**, targeting the Windows Network File System (NFSv4.1) kernel-mode driver (`nfssvr.sys`).

    ★ 3 · created 2026-01-31

  7. ksk-itdk/KSK-ITDK-CVE-2026-21509-Mitigation ↗Trust ok 100

    Powershell script with Detection and Remediation for CVE-2026-21509

    ★ 2 · created 2026-01-29

  8. SimoesCTT/SCTT-2026-33-0007-The-OLE-Vortex-Laminar-Bypass- ↗Trust ok 100

    Microsoft just released emergency patches for CVE-2026-21509, a zero-day in the Office Suite that bypasses OLE/COM mitigations when a user simply opens a file. They think their "Service-side change" for Office 2021+ is a solid wall.

    ★ 1 · created 2026-01-31

  9. DameDode/CVE-2026-21509-POC ↗Trust ok 100

    POC for the Office vulnerability

    ★ 0 · created 2026-03-12

  10. kaizensecurity/CVE-2026-21509 ↗Trust ok 100

    ★ 0 · created 2026-02-05

  11. planetoid/cve-2026-21509-mitigation ↗Trust ok 100

    CVE-2026-21509 Mitigation

    ★ 0 · created 2026-02-11

  12. razureink/cve-2026-21509-office_security_bypass_reproduction ↗Trust ok 100

    CVE Reproduction: cve-2026-21509-office_security_bypass_reproduction

    ★ 0 · created 2026-07-23

  13. sentinel-aidefense/CVE-2026-21509 ↗Trust ok 100

    CVE-2026-21509 Research writeup

    ★ 0 · created 2026-06-30

Fake proof-of-concept repositories have been used to deliver malware to the researchers who run them. The trust verdict is our engine's heuristic over the repository (account age, what it ships, how its stars arrived); it is a reason to read the code first, not a finding about its author.

On the wire

0 dispatches

No dispatch on our wire has named this CVE yet.

Watch this one?

KEV additions reach Telegram and the KEV-only RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.