Microsoft Office Security Feature Bypass Vulnerability CVE 2026 21509
Query
// Sergio Albea 27-01-2026
let Fixed_Office2016 = "16.0.5539.1001";
let Fixed_Office2019 = "16.0.10417.20095";
DeviceTvmSoftwareInventory
| where SoftwareName has_any ("Office")
| extend V = tostring(SoftwareVersion)
| extend IsOffice2016 = SoftwareName has "2016"
| extend IsOffice2019 = SoftwareName has "2019"
| extend IsVuln =
case(
IsOffice2016 and (parse_version(V) < parse_version(Fixed_Office2016)), true,
IsOffice2019 and (parse_version(V) < parse_version(Fixed_Office2019)), true,
false
)
| where IsVuln == true
| project DeviceName, SoftwareName, strcat('🚨', SoftwareVersion), Fixed_Office2016, iff(SoftwareName contains "2016",'📣 Fixed_Office2016','📣 Fixed_Office2019')About this query
MITRE ATT&CK Technique(s)
| Technique ID | Title |
|---|---|
| T1211 | Exploitation for Defense Evasion |
Author: Sergio Albea (27/01/2026)
Microsoft Office Security Feature Bypass Vulnerability CVE-2026-21509
Microsoft disclosed CVE-2026-21509 an important vulnerability that allows attackers to bypass Office security protections when a user opens a malicious document (🔗 in the comments). Exploitation has already been observed in the wild. This mainly affects Office 2016 and 2019, which are still widely used.
✅ How to reduce the risk:
- Install the January 2026 security updates for Office 2016 / 2019
- If patching is delayed, apply the recommended registry mitigation to block the vulnerable COM/OLE control. (Microsoft 365 Apps and newer Office versions are protected via service-side mitigations (restart required)
Even “non-critical” Office vulnerabilities matter — a single document can be enough to trigger an attack.
🚨Execute the following KQL query to detect the affected Version
Explanation
This query is designed to help identify devices that are vulnerable to a specific Microsoft Office security issue, CVE-2026-21509, which allows attackers to bypass security protections. The vulnerability affects Office 2016 and 2019 versions. Here's a simple breakdown of what the query does:
-
Define Fixed Versions: It sets the fixed versions for Office 2016 and 2019, which are not vulnerable to the issue:
- Office 2016: Version "16.0.5539.1001"
- Office 2019: Version "16.0.10417.20095"
-
Filter Software Inventory: It looks through the software inventory for any software with "Office" in its name.
-
Determine Vulnerability:
- It checks if the software is Office 2016 or 2019. - It compares the current version of the software against the fixed versions.
- If the current version is older than the fixed version, it marks the software as vulnerable.
-
Output Results: For each vulnerable device, it displays:
- Device name
- Software name
- Current software version (highlighted with an alert emoji 🚨)
- The fixed version it should be updated to
- A note indicating which fixed version applies (either for Office 2016 or 2019, marked with 📣)
This query helps IT administrators quickly identify and prioritize devices that need updates to mitigate the vulnerability.
