Microsoft Rushes Emergency Patch for Office Zero-Day

Microsoft issued an emergency patch for a zero-day vulnerability (CVE-2026-21509, CVSS 7.8) in Office and Microsoft 365 that allows bypass of COM/OLE protection and remote code execution; Microsoft observed active exploitation and CISA added the flaw to its Known Exploited Vulnerabilities catalog, while vendors characterize the exploit as complex and likely used in targeted, potentially state-sponsored or espionage-related attacks, and Microsoft and vendors have published mitigations and updates for affected versions.