Office zero-day exploited in the wild forces Microsoft OOB patch

Microsoft issued an emergency patch for CVE-2026-21509, a CVSS 7.8 security-feature-bypass zero-day in Office that is being exploited in the wild via malicious documents that convince users to open them; the flaw abuses legacy COM/OLE components, affects a wide range of Office versions (with fixes available for newer builds but not yet for Office 2016/2019), and CISA has added it to its Known Exploited Vulnerabilities catalog while Microsoft recommends registry-based mitigations for affected customers.