A bug in Microsoft Office lets a booby-trapped document get around a safety check that normally blocks risky content. Attackers sent such documents by email. Microsoft released fixes in January 2026. Microsoft 365 users get the fix after Office restarts; some older Office versions needed extra steps from Microsoft.
- Status
- Patched: update now
- Being attacked?
- Yes[2]
- Severity
- High
- Updated
CISA lists it as used in real attacks (added Jan 26, 2026). Microsoft marks it as exploited. Severity: Patch Gap rating: high, because CISA lists it as used in real attacks (we do not copy a score we have not checked). First reported .
Am I affected?
You are at risk if you use Office on Windows and it has not updated since January 2026. Older boxed versions (Office 2016 and 2019) needed a separate fix, so check Microsoft's page for your version.
| App | Device | Affected | Fixed in |
|---|---|---|---|
| Microsoft Office (Word, Excel, Outlook, PowerPoint) | Windows | Microsoft Office on Windows (Microsoft 365, Office 2016, 2019, 2021 and 2024) without Microsoft's January 2026 fix | Fixed by Microsoft's January 2026 Office updates or any newer update. Microsoft's page lists the fix for each Office version.[1] |
How to check your version
These checks only look. They do not change anything on your computer.
Microsoft Office (Word, Excel, Outlook, PowerPoint) on Windows
Easy way: Open Word (or Excel). Click File > Account > Update Options > Update Now. The version is shown under About Word.
Or type this in PowerShellRead-only. It only reads the version and changes nothing.
(Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Office\ClickToRun\Configuration' -ErrorAction SilentlyContinue).VersionToReport
How to fix it
- Open Word, Excel or any Office app.
- Click File > Account.
- Click Update Options > Update Now.
- Close all Office apps when asked so the update can finish.
- Do not open Office files from emails you did not expect.
More on each app: Is my Microsoft Office up to date?
Official links
Check before installing, and only use these official links or the app's own update button.
For AI agents
This page as data: /incidents/office-attacked-bug-jan-2026.json. All problems: /feed.json. Use read-only checks only, and ask before installing anything.
Tracking numbers (CVE): CVE-2026-21509
Sources
- MakerMicrosoft Security Update Guide: CVE-2026-21509 (January 2026 update) (Jan 26, 2026)
- CISACISA: Known Exploited Vulnerabilities catalog entry for CVE-2026-21509 (added 2026-01-26) (Jan 26, 2026)
- NVDNVD: CVE-2026-21509 (Jan 26, 2026)
"Maker", "CISA", "NVD", "GitHub advisory" and "Official notice" are official sources. "Researcher" and "News" are extra context.