Reliance on untrusted inputs in a security decision in Microsoft Office allows an unauthorized attacker to bypass a security feature locally.

Microsoft released this out of band update to address a security feature bypass vulnerability that has been exploited in the wild. Immediate patching is recommended

The Microsoft Office Products are missing security updates. It is, therefore, affected by a vulnerability:

  - A security feature bypass vulnerability. Reliance on untrusted inputs in a security decision in Microsoft     Office allows an unauthorized attacker to bypass a security feature locally. (CVE-2026-21509)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Microsoft Office Products are missing security updates. It is, therefore, affected by a security feature bypass vulnerability. 

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
298977	Security Updates for Microsoft Office Products C2R (February 2026)	Nessus	Windows	high
297128	Security Updates for Microsoft Office Products C2R (CVE-2026-21509)	Nessus	Windows	high
297127	Security Updates for Microsoft Office Products (CVE-2026-21509)	Nessus	Windows : Microsoft Bulletins	high

Detections

Analytics

CVE-2026-21509

high

Tenable Plugins

high

high

high