CVE-2026-21514: Microsoft Word security feature bypass via untrusted input

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

high priorityIt is in CISA KEV with known exploitation and a CVSS of 7.8, but requires local access and user interaction, limiting mass exploitation.

What it is

Microsoft Word relies on untrusted inputs when making a security decision, allowing an attacker to bypass a security feature. The flaw affects Microsoft 365 Apps and the Office Long Term Servicing Channel, and it is listed in CISA's Known Exploited Vulnerabilities catalog, so it warrants prompt attention despite a modest EPSS score.

Impact

An attacker can bypass a Word security feature, and the CVSS vector indicates high confidentiality, integrity and availability impact on the local system. The exact feature bypassed and the resulting capability are not detailed in the record.

Attack surface

The vector is local (AV:L) with no privileges required (PR:N) but user interaction required (UI:R), meaning the attacker must get a user to open or interact with a crafted file on the target machine. No remote or unauthenticated network path is described.

Exploitation

CVE-2026-21514 was added to CISA KEV on 2026-02-10 with a remediation due date of 2026-03-03, indicating known exploitation, though the EPSS 30-day probability is low at roughly 1.5 percent. No ransomware campaign use is documented.

What to do

• Apply the Microsoft update listed in the MSRC advisory for CVE-2026-21514 as the first action.
• Follow CISA BOD 22-01 guidance and the KEV required action, including discontinuing use if no mitigation is available.
• Restrict opening of untrusted or unsolicited Office documents, especially from email and downloads.
• Enable Protected View and block macros and embedded objects from untrusted sources in Word.
• Track the KEV due date of 2026-03-03 to confirm remediation is complete.

Detection

• Monitor for Word processes spawning unexpected child processes or writing to unusual locations after document open.
• Alert on Office documents received from external senders that trigger Protected View bypass or security prompt suppression.
• Review endpoint telemetry for anomalous file or registry activity originating from WINWORD.EXE.
• Check patch and version status of Microsoft 365 Apps and Office LTSC installations against the MSRC advisory.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.