US EditionPublished • loading... • Updated
Office Zero-Day Exploited, Forces Microsoft OOB Patch
Microsoft patched a high-severity Office zero-day exploited via low-complexity local attacks that bypass OLE mitigations, but updates for Office 2016 and 2019 are pending.
- On Monday, Microsoft disclosed CVE-2026-21509 and released emergency out-of-band updates rolling out for Microsoft 365 Apps for Enterprise and multiple Microsoft Office LTSC and perpetual releases.
- The flaw bypasses Object Linking and Embedding and COM mitigations, enabling attackers to exploit phishing-style, user-interaction attacks with circulating exploit code, Microsoft said.
- Microsoft published Registry mitigation steps to create a COM Compatibility key and set a Compatibility Flags value to 400; Office 2021 and later get auto-protection after restart, but patches for Microsoft Office 2016 and 2019 are pending.
- Close all Microsoft Office applications before editing the Windows Registry, back up the Registry to avoid system issues, and after performing the steps, the flaw is mitigated on next Office launch.
- Earlier this month, as part of the January 2026 Patch Tuesday, Microsoft fixed 114 flaws including an actively exploited Desktop Window Manager zero-day, and last week it issued other out-of-band fixes while declining to name the vulnerability's discoverer.
Insights by Ground AI
Podcasts & Opinions
25 Articles
25 Articles
Microsoft warns against a critical vulnerability in Office. The gap is already actively exploited, users should act quickly.
Coverage Details
Total News Sources25
Leaning Left2Leaning Right0Center4Last UpdatedBias Distribution67% Center
Bias Distribution
- 67% of the sources are Center
67% Center
L 33%
C 67%
Factuality
To view factuality data please Upgrade to Premium
