Microsoft Word Security Feature Bypass Vulnerability (CVE-2026-21514)

What is affected, what to do

Reliance on untrusted inputs in a security decision in Microsoft Office Word allows an unauthorized attacker to bypass a security feature locally.

The vulnerability is being actively exploited; treat it as a priority. Update Microsoft Office LTSC for Mac 2021 to version 16.106.26020821, Microsoft Office LTSC for Mac 2024 to version 16.106.26020821. Immediate actions, mitigation and detection rules are in the runbook below.

Affected

• Microsoft 365 Apps for Enterprise gte 16.0.1..*
• Microsoft Office LTSC 2021 gte 16.0.1..*
• Microsoft Office LTSC 2024 gte 16.0.0..*
• Microsoft Office LTSC for Mac 2021 lt 16.0.1..16.106.26020821
• Microsoft Office LTSC for Mac 2024 lt 16.0.0..16.106.26020821

Fixed in

• Microsoft Office LTSC for Mac 2021 16.106.26020821
• Microsoft Office LTSC for Mac 2024 16.106.26020821

Not sure whether and how you are affected? Ask a question about this vulnerability

Metrics

Response and mitigation

1. 01

   Runbook step 1

   Immediate response (0-24 h)

   • Deploy the security update: Microsoft has released an official fix for Microsoft 365 Apps for Enterprise, Office LTSC 2021 and Office LTSC 2024. The context does not supply Windows build numbers — look up the fixed builds in the MSRC advisory for CVE-2026-21514. Force the update across all Microsoft 365 Apps channels (Current, Monthly Enterprise, Semi-Annual) via Intune, ConfigMgr or the Office Deployment Tool rather than waiting for the staged rollout.
   • macOS endpoints: Bring Office LTSC for Mac 2021/2024 to 16.106.26020821 or later. Enforce Microsoft AutoUpdate with a deadline via MDM (Jamf/Intune).
   • Verify coverage: Query Defender Vulnerability Management, your EDR or ConfigMgr for Office builds below the advisory's fixed version. Fast-track phishing-exposed groups first: finance, HR, procurement and executives.
   • Tighten the mail gateway: Until rollout is complete, route externally sourced Word attachments (.doc, .docx, .docm, .rtf, .dot, .dotm) to sandbox detonation or quarantine. Exploitation requires a user to open a crafted document.
   • Start a retro-hunt: Search mailboxes and download folders back to late January 2026 for external Word documents that led to WINWORD.EXE child processes or outbound connections on endpoints (see Detection rules).
   • Classification note: CISA labels this vulnerability privilege escalation, while NVD labels it a security feature bypass. Operationally, treat it as a crafted document bypassing Office protections such as Protected View, Mark-of-the-Web checks or OLE/content blocking.
2. 02

   Runbook step 2

   Mitigation layers

   • Endpoint hardening (ASR): Set these Defender ASR rules to Block:

     • "Block all Office applications from creating child processes" (D4F940AB-401B-4EFC-AADC-AD5F3C50688A)
     • "Block Office applications from creating executable content" (3B576869-A4EC-4529-8536-B80A7769E899)
     • "Block Office applications from injecting code into other processes" (75668C1F-73B5-4CF0-BB93-3ECF5CB7CC84)

     These rules still fire if Word's own security decision is bypassed.

   • Office configuration via GPO/Intune:

     • Enforce Protected View for internet-zone files and Outlook attachments.
     • Block macros in files from the internet.
     • Use Trust Center File Block settings to force legacy formats (Word 97-2003, RTF) from untrusted sources to open in Protected View only.
     • Restrict OLE/ActiveX activation.

   • IAM / least privilege: Remove local admin rights from standard users (LAPS, Endpoint Privilege Management). This confines a successful bypass to the user context.

   • Network layer:

     • Restrict WINWORD.EXE egress via host firewall or proxy policy to known Microsoft endpoints.
     • Block outbound SMB (TCP 445/139) at the perimeter.
     • Block WebDAV to the internet (User-Agent "Microsoft-WebDAV-MiniRedir" over 80/443) to break common document-borne staging chains.

   • Application control: Use WDAC/AppLocker to deny mshta.exe, wscript.exe and cscript.exe for standard users. Block execution from %TEMP%, %APPDATA% and INetCache paths.

3. 03

   Runbook step 3

   Detection rules

   • Process ancestry (Sysmon EID 1 / EDR): WINWORD.EXE spawning cmd.exe, powershell.exe, pwsh.exe, mshta.exe, rundll32.exe, regsvr32.exe, wscript.exe, cscript.exe or certutil.exe. KQL: DeviceProcessEvents | where InitiatingProcessFileName =~ "winword.exe" and FileName in~ ("cmd.exe","powershell.exe","mshta.exe","rundll32.exe","regsvr32.exe","wscript.exe","certutil.exe")
   • ASR events: Microsoft-Windows-Windows Defender/Operational, Event ID 1121 (blocked) and 1122 (audit) with WINWORD.EXE as the source. Treat any hit on an unpatched host as an incident.
   • Network telemetry (Sysmon EID 3 / Zeek): WINWORD.EXE connecting to non-Microsoft destinations shortly after an attachment is opened. Watch especially for external SMB (445) or HTTP requests with User-Agent "Microsoft Office Protocol Discovery" or "Microsoft-WebDAV-MiniRedir".
   • File creation (Sysmon EID 11): WINWORD.EXE writing executables (.exe, .dll, .hta, .lnk, .js, .vbs) to %TEMP%, %APPDATA% or Startup folders. Sigma shape: Image|endswith: '\WINWORD.EXE' with TargetFilename|endswith: ['.exe','.dll','.hta','.lnk','.js','.vbs'].
   • macOS (EDR / unified log): "Microsoft Word" spawning /bin/sh, /bin/zsh, osascript or curl. This ancestry is atypical in normal use.

Detection rules

No NEOSEC detection rule is available for this vulnerability yet.

Classification under NIS2 and CRA

Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

NIS2

NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

Read in glossary

Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).

CRA

The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

Read in glossary

Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.

ISO/IEC 27001

ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

Read in glossary

Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

Description

Reliance on untrusted inputs in a security decision in Microsoft Office Word allows an unauthorized attacker to bypass a security feature locally.

Source: pwn.watch, NVD (NIST), Microsoft Security Update Guide, cvelistv5, CISA KEV Catalog, ENISA EUVD, CVE.org (MITRE)

Vendors and products

• Microsoft Microsoft 365 Apps for Enterprise
• Microsoft Microsoft 365 Apps For Enterprise
• Microsoft Microsoft Office Ltsc 2021
• Microsoft Microsoft Office Ltsc 2024
• Microsoft Microsoft Office Ltsc For Mac 2021
• Microsoft Microsoft Office Ltsc For Mac 2024
• Microsoft Microsoft Office LTSC for Mac 2021

Weakness classes (CWE)

• CWE-807Reliance on Untrusted Inputs in a Security Decision

  Base

  The product uses a protection mechanism that relies on the existence or values of an input, but the input can be modified by an untrusted actor in a way that bypasses the protection mechanism.

  Entry at MITRE CWE-807

References & sources

• Microsoft Security Update GuideMicrosoft Word Security Feature Bypass Vulnerabilityeuvd, Vendor advisory, Patch, Vendor advisory, pwn-watch
• cisa.govknown-exploited-vulnerabilities-catalog?field_cve=CVE-2026-21514government-resource, US government resource
• pwn.watchpwn.watch: Microsoft Office: Microsoft Office Word Reliance on Untrusted Inputs in a Security Decision Vulnerabilitypwn-watch
• NVD (NIST)NVD: CVE-2026-21514pwn-watch
• cisa.govCISA Known Exploited Vulnerabilities Catalogpwn-watch