Reliance on untrusted inputs in a security decision in Microsoft Office allows an unauthorized attacker to bypass a security feature locally.

Microsoft released this out of band update to address a security feature bypass vulnerability that has been exploited in the wild. Immediate patching is recommended

The Microsoft Office Products are missing security updates. It is, therefore, affected by a vulnerability:

  - A security feature bypass vulnerability. Reliance on untrusted inputs in a security decision in Microsoft     Office allows an unauthorized attacker to bypass a security feature locally. (CVE-2026-21509)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Microsoft Office Products are missing security updates. It is, therefore, affected by a security feature bypass vulnerability. 

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
298977	Security Updates for Microsoft Office Products C2R (February 2026)	Nessus	Windows	Local	high
297128	Security Updates for Microsoft Office Products C2R (CVE-2026-21509)	Nessus	Windows	Local	high
297127	Security Updates for Microsoft Office Products (CVE-2026-21509)	Nessus	Windows : Microsoft Bulletins	Local	high

Detections

Analytics

CVE-2026-21509

high

Tenable Plugins

high

high

high