Microsoft releases update to address zero-day vulnerability in Microsoft Office

Microsoft released out-of-band updates in January 2026 to address CVE-2026-21509, a security feature bypass in Microsoft Office (CVSS 7.8) that has been reportedly exploited in the wild and added to CISA's Known Exploited Vulnerabilities list; Microsoft published mitigations and Talos released Snort rules and a ClamAV signature to detect exploitation attempts.