CVE-2026-21509

What it actually does

The vulnerability is an authorization/security-feature bypass caused by trusting attacker-controlled input when making a security decision. Exploitation requires local interaction and user action, such as opening or handling crafted content, but does not require attacker authentication. A successful bypass can cause protective controls to make an incorrect trust decision, potentially allowing unsafe content or operations to run with fewer restrictions than intended. The CVSS vector indicates high confidentiality, integrity, and availability impact once the bypass is successfully chained or abused.

Why it matters to the business

Because this vulnerability is listed in CISA KEV, has active in-the-wild exploitation, and has a high EPSS score, organizations should treat it as urgent even though exploitation requires user interaction. Successful exploitation can undermine endpoint protections, increase the likelihood of malware execution from crafted documents or local content, and lead to data theft, system compromise, operational disruption, or follow-on lateral movement. CISA’s remediation deadline is 2026-02-16 for covered organizations, and broader organizations should use that date as a risk-based prioritization benchmark.

How an attack unfolds

An attacker typically delivers or stages crafted content that influences how the affected software makes a trust or authorization decision. The victim must interact with the content locally, for example by opening a document, file, or related payload. Due to reliance on untrusted input, the application or component treats the content as safer or more authorized than it should be, bypassing a security feature that would normally restrict execution, access, or unsafe behavior. The attacker can then use the bypass to enable follow-on actions such as launching embedded content, invoking scripts or helper binaries, dropping payloads, or establishing persistence. Active exploitation in the wild means defenders should assume weaponized lures and post-exploitation activity may already exist, even if the initial bypass itself leaves limited standalone artifacts.

How to fix it

Apply vendor fixes as soon as possible and prioritize internet-facing file-handling workflows, high-risk user groups, and systems that process untrusted documents or downloads. For the affected package data provided, upgrade Debian 11 systems to linux version 5.10.158-1 or later, and Debian 12 and Debian 13 systems to linux version 6.0.7-1 or later. Where Microsoft Office is deployed, apply the relevant Microsoft security updates for this vulnerability and ensure Office Click-to-Run, MSI, and enterprise-managed channels are fully updated. Until patching is complete, restrict opening of untrusted files, enforce Protected View and application control, block Office child-process creation where operationally feasible, disable or tightly control macros and active content, and use email/web filtering to quarantine suspicious attachments and downloaded documents. Because the supplied affected-product metadata references Debian Linux while the vulnerability description references Microsoft Office, validate vendor advisories and asset inventories to ensure all applicable products are covered.

How to confirm the fix worked

Confirm remediation by verifying installed package or application versions against the fixed versions and vendor advisories. On Debian systems, inventory installed linux package versions and confirm Debian 11 is at 5.10.158-1 or later and Debian 12/13 are at 6.0.7-1 or later. For Office deployments, verify update channel compliance and installed builds through endpoint management, software inventory, or the Office account/update interface. Validate that endpoint controls remain enabled, including Protected View, Mark-of-the-Web handling, macro restrictions, and application-control policies. Review a representative sample of systems for attempted exploitation indicators, especially Office or document-handling processes spawning scripting engines, shells, archive utilities, or download tools. If using vulnerability scanners, confirm their plugins map to the correct vendor advisory and do not rely solely on the inconsistent product metadata in the input.

Typical attack path

1. Attacker prepares crafted local content designed to influence a security decision.
2. Attacker delivers the content through email, web download, removable media, file share, chat, or another user-accessible channel.
3. Victim opens or interacts with the crafted content on an affected system.
4. The vulnerable component incorrectly trusts attacker-controlled input and bypasses the intended security feature.
5. Attacker-controlled behavior executes with reduced restrictions or enables access that should have been blocked.
6. Attacker uses the foothold for payload execution, credential access, persistence, data collection, or lateral movement.

How to detect it

There may be no single definitive log entry for the bypass itself, so detection should focus on the full intrusion chain. Review EDR, Sysmon, Windows Security logs, Office telemetry, email gateway logs, web proxy logs, file-download telemetry, and endpoint file-system artifacts for suspicious document handling followed by unusual child processes or network activity. Look for Office applications or document viewers spawning command shells, PowerShell, Windows Script Host, MSHTA, rundll32, regsvr32, certutil, curl, wget, or archive/extraction utilities. Correlate suspicious attachments or downloads with subsequent process creation, file writes in user-writable directories, persistence changes, credential-access tooling, or outbound connections to newly observed domains. Check whether downloaded files lack expected Mark-of-the-Web Zone.Identifier metadata or show signs that trust metadata was manipulated. On Debian systems, review package versions and system logs for exploitation chains that may have occurred before upgrade, especially unusual local privilege, process-spawn, or persistence events. Because active exploitation is reported, prioritize retrospective hunting from at least the publication date forward, and longer where phishing or suspicious document activity is present.

• WINWORD.EXE -> powershell.exe
• WINWORD.EXE -> cmd.exe
• WINWORD.EXE -> wscript.exe
• WINWORD.EXE -> cscript.exe
• WINWORD.EXE -> mshta.exe
• WINWORD.EXE -> rundll32.exe
• WINWORD.EXE -> regsvr32.exe
• WINWORD.EXE -> certutil.exe
• EXCEL.EXE -> powershell.exe
• EXCEL.EXE -> cmd.exe
• EXCEL.EXE -> wscript.exe
• EXCEL.EXE -> cscript.exe
• EXCEL.EXE -> mshta.exe
• POWERPNT.EXE -> powershell.exe
• POWERPNT.EXE -> cmd.exe
• POWERPNT.EXE -> wscript.exe
• POWERPNT.EXE -> cscript.exe
• POWERPNT.EXE -> mshta.exe
• OUTLOOK.EXE -> WINWORD.EXE
• Zone.Identifier
• [ZoneTransfer]
• ZoneId=3
• /tmp/.X11-unix
• /var/tmp/
• /dev/shm/
• dpkg -l linux-image
• linux-image-5.10.158-1
• linux-image-6.0.7-1

What your security team should do

• Treat as priority patching because the vulnerability is in CISA KEV, is actively exploited in the wild, and has a high EPSS score.
• Complete remediation before 2026-02-16 where KEV-driven deadlines apply; otherwise use the same date as an internal target.
• Reconcile asset scope between Microsoft Office exposure and the Debian Linux affected-package data, then patch both any confirmed Office deployments and any affected Debian linux packages.
• Hunt for recent suspicious document-open events followed by Office, viewer, or document-handling applications spawning script interpreters, shells, or network utilities.
• Harden document-handling controls: enforce Protected View, preserve Mark-of-the-Web, block macros from the internet, and restrict Office child processes.
• Increase scrutiny of inbound attachments, downloaded documents, archive files, and files delivered through collaboration platforms.
• Ensure EDR/SIEM detections cover post-exploitation behaviors rather than only the bypass condition, which may not generate a unique log entry.
• Perform targeted forensic review on systems belonging to users who opened suspicious documents around and after the publication date.