overview

CVE-2026-21514 is a security feature bypass vulnerability in Microsoft Word due to reliance on untrusted inputs in a security decision (CWE-807), allowing an unauthorized local attacker to bypass protections against dangerous COM/OLE controls by opening a specially crafted Word document.

Affected Products and Versions

  • Microsoft Word (specific versions not detailed in advisories; affects supported versions vulnerable to crafted Office files).

Microsoft released security updates on February 10, 2026, to address this issue; apply the latest patches from the Microsoft Security Update Guide.

Current Threat Status

This vulnerability was publicly disclosed and actively exploited in the wild as a zero-day prior to patching, requiring user interaction to open a malicious Office document (preview pane not affected). Exploitation enables bypass leading to potential code execution via malicious COM/OLE controls, with credits to anonymous researchers, Google Threat Intelligence Group, Microsoft Threat Intelligence Center, MSRC, and Office Product Group Security Team; no specific industries or common techniques beyond document opening detailed.

 

SUmmary

CVSS Score: 7.8 (High).
CVSS Vector String: Not currently provided or confirmed in available sources.
KEV: Not listed in the CISA KEV catalog.
EPSS: Not provided or confirmed in the search results.
CWE: CWE-807 (Reliance on Untrusted Inputs in a Security Decision).

Compliance Impact (CVSS ≥ 7.0)

This vulnerability, a security feature bypass in Microsoft Word due to reliance on untrusted inputs allowing local unauthorized access, has compliance implications for systems handling sensitive data:

  • PCI DSS – Violates requirements 6.2 (timely vulnerability patching) and 7.2 (restrict access to privileged accounts), risking unauthorized access to cardholder data environments.

  • HIPAA – Impacts safeguards for ePHI confidentiality (45 CFR § 164.312), as bypassing security features could expose Protected Health Information via local attacks.

  • SOX – Affects internal controls over financial reporting (Section 404), potentially enabling integrity violations in document processing workflows.

  • ISO 27001 – Breaches A.9.4 (access control) and A.12.6 (technical vulnerability management) through inadequate input validation in security decisions.

  • NIST CSF – Impacts "Protect" (PR.AC-1: Identities and Access; PR.DS-5: Data Security) and "Identify" (ID.RA-5: Vulnerabilities) functions.

 

Indicators of compromise (IOCs)

At this time, there are no known IOCs associated with successful exploitation of CVE-2026-21514. Avertium remains vigilant in locating IOCs for our customers and will disclose them as soon as possible.

For more information on how Avertium can help protect your organization, please reach out to your Avertium Service Delivery Manager or Account Executive.

 

mitre att&ck ttps

TTPs to Monitor

Defense Evasion

  • T1562.001 - Impair Defenses: Disable or Modify Tools: The vulnerability allows bypassing Microsoft Word's security features by relying on untrusted inputs in security decisions, enabling attackers to evade local security mechanisms.

  • T1222 - File and Disk Permissions Modification: Exploitation could involve bypassing security restrictions locally to modify or access protected files in Word, evading document-level protections.

Execution

  • T1203 - Exploitation for Client Execution: Local exploitation of the security feature bypass in Microsoft Word enables execution of malicious content or payloads on the victim's system.

Initial Access

  • T1566.001 - Phishing: Spearphishing Attachment: Attackers commonly deliver malicious Word documents exploiting this CVE via phishing attachments to achieve initial local access.

 

additional recommendations and information

1. Immediate Mitigation

  • Enable Protected View in Microsoft Word to open documents from untrusted sources in a read-only sandbox, blocking active content until explicitly enabled.
  • Enforce Mark-of-the-Web (MOTW) on files from external sources to trigger Protected View automatically.
  • Disable or restrict OLE/COM object loading by applying a temporary registry-based killbit: Backup the Registry, close Word, navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\16.0\Common\COMCompatibility\{EAB22AC3-30C1-11CF-A7EB-0000C05BAE0B} (or WOW6432Node for 32-bit on 64-bit systems), create DWORD "Compatibility Flags" with value 400 (hex), then restart Word.
  • Limit user privileges to standard accounts and enable Attack Surface Reduction(ASR) rules to block Office apps from creating child processes or executable content.

2. Patch and Monitor Systems

  • Vendor patches are available for affected Microsoft Office versions (e.g., Office2021/M365 via service-side fix after restart; Office 2016 KB5002713; Office2019 to Build 10417.20095) - apply immediately via Microsoft Update, WSUS, or Download Center.
  • Restart all Office applications (Word, Excel, etc.) post-patch to ensure protections activate.
  • Monitor endpoints with EDR/XDR for indicators like unusual COM/OLE instantiation by WINWORD.EXE, unexpected child processes, or registry changes to COM Compatibility keys.
  • Verify Office build numbers after updates and watch vendor advisories (e.g., MSRC) for CVE-2026-21514-specific confirmations.

3. Network Security

  • Strengthen email gateways to quarantine Office documents with embedded OLE/COM objects from untrusted sources.
  • Deploy intrusion detection/prevention systems (IDS/IPS) and Microsoft Defender rules targeting Office exploitation behaviors (e.g., network connections from WINWORD.EXE).
  • Isolate vulnerable Word/Office systems on segmented networks and monitor for local privilege escalation or anomalous local file access.

 

additional service offerings

Microsoft Security Solutions
Avertium's Microsoft Security Solutions provide configuration, deployment, and optimization of Microsoft security products like Defender XDR, Sentinel, Purview, Entra ID, and Intune, directly addressing vulnerabilities in Microsoft Word by enhancing endpoint protection, identity management, and data security to prevent local security feature bypass exploits.

Fusion MXDR
Fusion MXDR offers 24/7 managed extended detection and response through Cyber Fusion Centers, fusing threat intelligence, AI-driven analytics, and automated responses via Fusion Engine 2.0 to monitor Microsoft Office environments, detect unauthorized local access attempts, and disrupt attacks exploiting untrusted inputs in Word.

Security Information and Event Management (SIEM)
Avertium’s SIEM integration within managed XDR services delivers holistic visibility into IT environments, enabling real-time detection of anomalous behavior in Microsoft Word such as reliance on untrusted inputs, allowing security teams to investigate and respond before bypasses lead to compromise.

Cybersecurity Strategy Alignment
Avertium aligns cybersecurity strategy with business goals through assessments, threat mapping using MITRE ATT&CK, and cyber maturity roadmaps, including vulnerability assessments and secure configuration for Microsoft Office to mitigate local bypass risks via policy development, training, and resilience planning.

 

 

SUPPORTING DOCUMENTATION








 
microsoft Flash Notice Microsoft Vulnerability Microsoft Office Microsoft Word authentication bypass vulnerability Blog