CVE-2026-21509Vulnerability
Microsoft Office Security Feature Bypass Vulnerability
Reported by 7 independent sources · first reported by CERT-UA · last reported
Last reported 4 days ago
Fix due 16 Feb 2026
Used by ransomware: not knownCISA KEV catalogue
higher than 99% of CVEsFIRST EPSS, as of 23 Oct 2026
What the reports say
8 reports, newest first · the exact sentence from each-
Russian APT28 Breaches NATO Naval Shipbuilder in NATO Country, Deploys New Reflective Loader“CERT-UA also said it observed APT28 exploiting vulnerabilities such as CVE-2026-21509, a security feature bypass in Microsoft Office, and CVE-2026-8496, a zero-click vulnerability in the SOGo webmail client, to deliver the COVENANT malware as well as siphon victims' mailbox crede…”
-
Cyber Brief 26-02 - January 2026“Microsoft Office CVE-2026-21509 zero-day exploited”
-
Cyber Brief 26-03 - February 2026“… Signal messaging app phishing campaign reportedly targeted high-profile figures across Europe, while Russia-linked APT28 weaponised CVE-2026-21509 in a campaign targeting users in Central and Eastern Europe.”
-
June 2026 CVE Landscape“CVE-2026-21509”
-
Pawn Storm Campaign Deploys PRISMEX, Targets Government and Critical Infrastructure Entities“The .lnk files retrieved via CVE-2026-21509 (a security feature bypass vulnerability in the Microsoft Office Object Linking and Embedding (OLE) mechanism) may chain with CVE-2026-21513 (a Protection mechanism failure in MSHTML Framework) based on shared command-and-control infras…”
-
Sednit reloaded: Back in the trenches“In January 2026, Sednit also deployed Covenant in a series of spearphishing campaigns exploiting the CVE-2026-21509 vulnerability, as reported by CERT‑UA.”
-
APT28 Leverages CVE-2026-21509 in Operation Neusploit“APT28 Leverages CVE-2026-21509 in Operation Neusploit”
-
"Бюлетень небезпеки": UAC-0001 (APT28) здійснює кібератаки у відношенні України та країн ЄС з використанням експлойту CVE-2026-21509 (CERT-UA#19542)“"Бюлетень небезпеки": UAC-0001 (APT28) здійснює кібератаки у відношенні України та країн ЄС з використанням експлойту CVE-2026-21509 (CERT-UA#19542)”
Indicators reported together
named in the same reports- wellnesscaremed[.]comin 2 reports
Copy this indicator · defanged
Also named with it: CVE-2026-1281, CVE-2025-8088, CVE-2026-21513, CVE-2026-25089, CVE-2026-39808, CVE-2026-11645, CVE-2026-28318, CVE-2026-20230, CVE-2026-35616, CVE-2026-33825, CVE-2025-55182, CVE-2026-1340, CVE-2025-26399, CVE-2025-40551, CVE-2026-22769, CVE-2025-53690, CVE-2025-64155, CVE-2026-20045, CVE-2025-6218
Thanks — we review every report.