CVE-2026-21509: APT28 Exploits Microsoft Office Zero-day Vulnerability

Microsoft disclosed CVE-2026-21509, a critical RTF-parsing zero-day in Office (CVSS 7.8) that allows remote code execution; APT28 (Fancy Bear) exploited it in January 2026 in Operation Neusploit against Ukrainian targets, delivering payloads such as MiniDoor, PixyNetLoader, and a Covenant-based backdoor to achieve persistence, data theft, and remote control. The report outlines the exploitation chain, affected products and versions, persistence and C2 behaviors, mitigation guidance, and offers security validation simulation via the Picus platform.