CVE-2026-21514

high Microsoft ⚠️ CISA KEV — Exploited in the Wild
CVSS v3 Base Score
7.8
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C
Published: February 10, 2026
Last Modified: March 13, 2026
Vendor: Microsoft
Source: MITRE

⚠️ CISA Known Exploited Vulnerability

Added to KEV: 2026-02-10
Remediation Due: 2026-03-03

Description

Reliance on untrusted inputs in a security decision in Microsoft Office Word allows an unauthorized attacker to bypass a security feature locally.

CWE

CWE-807

Affected Products

Microsoft Microsoft 365 Apps for EnterpriseMicrosoft Microsoft Office LTSC 2021Microsoft Microsoft Office LTSC 2024Microsoft Microsoft Office LTSC for Mac 2021Microsoft Microsoft Office LTSC for Mac 2024

References

🔗 msrc.microsoft.com