{
 "schema_version": "1.0",
 "agent_rules": [
  "Use only read-only checks (the commands marked read_only, or the app's own About menu). Never run anything that changes the computer.",
  "Never install, update, uninstall or change settings without the user's clear OK for that exact step.",
  "Only give the user the official links in this feed (official_patch_links and sources). Never send them to a download from anywhere else.",
  "If you cannot tell whether the user is affected, say so plainly instead of guessing.",
  "Say 'unconfirmed' when an incident's confidence is 'unconfirmed'."
 ],
 "incident": {
  "id": "office-attacked-bug-jan-2026",
  "url": "https://patchgap.ai/incidents/office-attacked-bug-jan-2026/",
  "path": "/incidents/office-attacked-bug-jan-2026/",
  "json_url": "https://patchgap.ai/incidents/office-attacked-bug-jan-2026.json",
  "title": "Microsoft Office: a bug that lets a bad document skip Office's safety checks was used in real attacks",
  "category": "apps",
  "platforms": [
   "windows"
  ],
  "products": [
   "microsoft-office"
  ],
  "status": "patched",
  "status_label": "Patched: update now",
  "severity": "high",
  "severity_source": "Patch Gap rating: high, because CISA lists it as used in real attacks (we do not copy a score we have not checked).",
  "exploited_in_wild": "yes",
  "exploited_note": "CISA lists it as used in real attacks (added Jan 26, 2026). Microsoft marks it as exploited.",
  "exploited_source_url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
  "confidence": "confirmed",
  "confidence_note": null,
  "first_reported": "2026-01-26",
  "updated_at": "2026-10-27",
  "cves": [
   "CVE-2026-21509"
  ],
  "summary": "A bug in Microsoft Office lets a booby-trapped document get around a safety check that normally blocks risky content. Attackers sent such documents by email. Microsoft released fixes in January 2026. Microsoft 365 users get the fix after Office restarts; some older Office versions needed extra steps from Microsoft.",
  "am_i_affected": "You are at risk if you use Office on Windows and it has not updated since January 2026. Older boxed versions (Office 2016 and 2019) needed a separate fix, so check Microsoft's page for your version.",
  "action": "Update Office (January 2026 update or newer)",
  "affected": [
   {
    "product": "microsoft-office",
    "product_name": "Microsoft Office (Word, Excel, Outlook, PowerPoint)",
    "platform": "windows",
    "affected_versions": "Microsoft Office on Windows (Microsoft 365, Office 2016, 2019, 2021 and 2024) without Microsoft's January 2026 fix",
    "fixed_version": null,
    "fixed_min": null,
    "fix_note": "Fixed by Microsoft's January 2026 Office updates or any newer update. Microsoft's page lists the fix for each Office version.",
    "fixed_source_urls": [
     "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21509"
    ],
    "check": {
     "menu_path": "Open Word (or Excel). Click File > Account > Update Options > Update Now. The version is shown under About Word.",
     "command": "(Get-ItemProperty 'HKLM:\\SOFTWARE\\Microsoft\\Office\\ClickToRun\\Configuration' -ErrorAction SilentlyContinue).VersionToReport",
     "shell": "PowerShell",
     "read_only": true
    },
    "official_download": "https://support.microsoft.com/office/install-office-updates-2ab296f3-7f03-43a2-8e50-46de917611c5"
   }
  ],
  "fix_steps": [
   "Open Word, Excel or any Office app.",
   "Click File > Account.",
   "Click Update Options > Update Now.",
   "Close all Office apps when asked so the update can finish.",
   "Do not open Office files from emails you did not expect."
  ],
  "official_patch_links": [
   {
    "label": "Microsoft: install Office updates",
    "url": "https://support.microsoft.com/office/install-office-updates-2ab296f3-7f03-43a2-8e50-46de917611c5"
   },
   {
    "label": "Microsoft: CVE-2026-21509 details",
    "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21509"
   }
  ],
  "extra_checks": [],
  "sources": [
   {
    "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21509",
    "title": "Microsoft Security Update Guide: CVE-2026-21509 (January 2026 update)",
    "date": "2026-01-26",
    "kind": "vendor",
    "official": true
   },
   {
    "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
    "title": "CISA: Known Exploited Vulnerabilities catalog entry for CVE-2026-21509 (added 2026-01-26)",
    "date": "2026-01-26",
    "kind": "cisa",
    "official": true
   },
   {
    "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-21509",
    "title": "NVD: CVE-2026-21509",
    "date": "2026-01-26",
    "kind": "nvd",
    "official": true
   }
  ]
 }
}