{"id":"microsoft-office-ole-bypass-exploited-jan-2026","category":"patch","status":"closed","title":"Microsoft Office zero-day CVE-2026-21509 exploited; emergency fixes for Office 2016 to 365","tldr":"Microsoft issued emergency fixes for CVE-2026-21509, an Office flaw used in attacks, later tied to Russia-linked APT28. Install Office updates for 2016 and 2019. Office 2021 and later are protected by a change Microsoft applies itself; restart your Office apps.","summary":"On 26 January 2026 Microsoft released emergency protection for CVE-2026-21509, a flaw in Microsoft Office that let a booby-trapped document get past Office's OLE security protections. CISA listed it as exploited that day. Microsoft rates it high severity (CVSS 7.8). Affected products are Office 2016, 2019, LTSC 2021, LTSC 2024 and Microsoft 365 Apps. Office 2021 and later received a Microsoft-side change that takes effect after Office apps are restarted, while Office 2016 and 2019 got standard security updates on 28 January. The Preview Pane is not an attack route; the victim has to open the file. Zscaler reported exploitation by the Russia-linked group APT28 from 29 January, against targets in Ukraine, Slovakia and Romania, using RTF documents to install an email stealer or remote-access tools. CISA set a 16 February patching deadline for US federal agencies. Microsoft's own advisory page could not be read for this record, so details come from press reports. No later developments were found.","action":"Install the latest Office updates (Office 2016 and 2019 need them installed), and fully close and reopen Office apps if you use Office 2021, 2024 or Microsoft 365. Be wary of opening unexpected Office or RTF attachments.","product":"Microsoft Office 2016, 2019, 2021, 2024 and Microsoft 365 Apps","audience":"both","severity":"high","patch":"patched","exploited":true,"cves":["CVE-2026-21509"],"tags":["microsoft","office","microsoft-365","zero-day","security-bypass","apt28","windows","exploited"],"affected":["Microsoft Office 2016","Microsoft Office 2019","Microsoft Office LTSC 2021","Microsoft Office LTSC 2024","Microsoft 365 Apps for Enterprise"],"fixed":["Office 2016: 16.0.5539.1001","Office 2019: 16.0.10417.20095","Office LTSC 2021, LTSC 2024 and Microsoft 365 Apps: see aka.ms/OfficeSecurityReleases"],"matches":[{"platform":"windows","app":"Microsoft Office 2016","bundle":"","fixed":"16.0.5539.1001"},{"platform":"windows","app":"Microsoft Office 2019","bundle":"","fixed":"16.0.10417.20095"}],"sources":[{"kind":"advisory","title":"Microsoft Office Security Feature Bypass Vulnerability CVE-2026-21509","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21509","by":"Microsoft MSRC","date":"2026-01-26"},{"kind":"news","title":"Microsoft patches actively exploited Office zero-day vulnerability","url":"https://www.bleepingcomputer.com/news/microsoft/microsoft-patches-actively-exploited-office-zero-day-vulnerability/","by":"BleepingComputer","date":"2026-01-26"},{"kind":"news","title":"APT28 exploits Microsoft Office vulnerability in spear phishing campaign","url":"https://www.csoonline.com/article/4127181/apt28-exploits-microsoft-office-vulnerability-in-spear-phishing-campaign.html","by":"CSO Online","date":"2026-02-04"}],"started":"2026-01-26","closed":"2026-02-04","created":"2026-11-03T21:26:22.349Z","updated":"2026-11-03T21:26:22.349Z","cve_notes":[{"cve":"CVE-2026-21509","name":"Security feature bypass in Microsoft Office (OLE)","what":"A flaw in Microsoft Office where a security decision relied on untrusted input, letting a booby-trapped document bypass Office's OLE protections against dangerous embedded components once the victim opens it.","severity":"high","cvss":7.8}],"timeline":[{"at":"2026-02-04","added":"2026-11-03T21:23:52.346Z","kind":"other","text":"Reporting detailed the campaign, called Operation Neusploit: the documents installed an email stealer (MiniDoor) or a longer-term remote-access chain (PixyNetLoader and Covenant Grunt). CISA set 16 February 2026 as the deadline for US federal agencies to patch.","url":"https://www.csoonline.com/article/4127181/apt28-exploits-microsoft-office-vulnerability-in-spear-phishing-campaign.html","by":"CSO Online","patch":null},{"at":"2026-01-29","added":"2026-11-03T21:23:52.346Z","kind":"wider-attacks","text":"Zscaler ThreatLabz recorded in-the-wild exploitation by APT28, a Russia-linked group, three days after the fix. Targets were users in Ukraine, Slovakia and Romania, using booby-trapped RTF documents.","url":"https://www.csoonline.com/article/4127181/apt28-exploits-microsoft-office-vulnerability-in-spear-phishing-campaign.html","by":"CSO Online","patch":null},{"at":"2026-01-28","added":"2026-11-03T21:23:52.346Z","kind":"new-fix","text":"Microsoft added standard security updates for Office 2016 and 2019. Office 2021 and later had received a service-side change that takes effect once Office apps are restarted.","url":"https://www.bleepingcomputer.com/news/microsoft/microsoft-patches-actively-exploited-office-zero-day-vulnerability/","by":"BleepingComputer","patch":"patched"},{"at":"2026-01-26","added":"2026-11-03T21:23:52.346Z","kind":"disclosed","text":"Microsoft released emergency out-of-band protection for CVE-2026-21509, a security feature bypass in Microsoft Office that was already being exploited. CISA listed it as exploited the same day.","url":"https://www.bleepingcomputer.com/news/microsoft/microsoft-patches-actively-exploited-office-zero-day-vulnerability/","by":"BleepingComputer","patch":"partial"}],"url":"https://hard.fyi/live/microsoft-office-ole-bypass-exploited-jan-2026/","json":"https://hard.fyi/api/live?id=microsoft-office-ole-bypass-exploited-jan-2026"}