Microsoft Office zero-day CVE-2026-21509 exploited; emergency fixes for Office 2016 to 365
Microsoft issued emergency fixes for CVE-2026-21509, an Office flaw used in attacks, later tied to Russia-linked APT28. Install Office updates for 2016 and 2019. Office 2021 and later are protected by a change Microsoft applies itself; restart your Office apps.
Install the latest Office updates (Office 2016 and 2019 need them installed), and fully close and reopen Office apps if you use Office 2021, 2024 or Microsoft 365. Be wary of opening unexpected Office or RTF attachments.
- Microsoft Office 2016fixed in 16.0.5539.1001 and later
- Microsoft Office 2019fixed in 16.0.10417.20095 and later
What’s happening
On 26 January 2026 Microsoft released emergency protection for CVE-2026-21509, a flaw in Microsoft Office that let a booby-trapped document get past Office's OLE security protections. CISA listed it as exploited that day. Microsoft rates it high severity (CVSS 7.8). Affected products are Office 2016, 2019, LTSC 2021, LTSC 2024 and Microsoft 365 Apps. Office 2021 and later received a Microsoft-side change that takes effect after Office apps are restarted, while Office 2016 and 2019 got standard security updates on 28 January. The Preview Pane is not an attack route; the victim has to open the file. Zscaler reported exploitation by the Russia-linked group APT28 from 29 January, against targets in Ukraine, Slovakia and Romania, using RTF documents to install an email stealer or remote-access tools. CISA set a 16 February patching deadline for US federal agencies. Microsoft's own advisory page could not be read for this record, so details come from press reports. No later developments were found.
- What
- Flaw
- Affects
- Microsoft Office 2016, 2019, 2021, 2024 and Microsoft 365 Apps
- Affected
- Microsoft Office 2016
Microsoft Office 2019
Microsoft Office LTSC 2021
Microsoft Office LTSC 2024
Microsoft 365 Apps for Enterprise - Fixed in
- Office 2016: 16.0.5539.1001
Office 2019: 16.0.10417.20095
Office LTSC 2021, LTSC 2024 and Microsoft 365 Apps: see aka.ms/OfficeSecurityReleases - Since
- 26 Jan 2026
- Closed
- 4 Feb 2026
Timeline
- Update
Reporting detailed the campaign, called Operation Neusploit: the documents installed an email stealer (MiniDoor) or a longer-term remote-access chain (PixyNetLoader and Covenant Grunt). CISA set 16 February 2026 as the deadline for US federal agencies to patch.
- Wider attacks
Zscaler ThreatLabz recorded in-the-wild exploitation by APT28, a Russia-linked group, three days after the fix. Targets were users in Ukraine, Slovakia and Romania, using booby-trapped RTF documents.
- New fixFixed
Microsoft added standard security updates for Office 2016 and 2019. Office 2021 and later had received a service-side change that takes effect once Office apps are restarted.
- Made publicPartly fixed
Microsoft released emergency out-of-band protection for CVE-2026-21509, a security feature bypass in Microsoft Office that was already being exploited. CISA listed it as exploited the same day.
Sources
- Microsoft Office Security Feature Bypass Vulnerability CVE-2026-21509Microsoft MSRC · 26 Jan 2026
- Microsoft patches actively exploited Office zero-day vulnerabilityBleepingComputer · 26 Jan 2026
- APT28 exploits Microsoft Office vulnerability in spear phishing campaignCSO Online · 4 Feb 2026