{
 "schema_version": "1.0",
 "agent_rules": [
  "Use only read-only checks (the commands marked read_only, or the app's own About menu). Never run anything that changes the computer.",
  "Never install, update, uninstall or change settings without the user's clear OK for that exact step.",
  "Only give the user the official links in this feed (official_patch_links and sources). Never send them to a download from anywhere else.",
  "If you cannot tell whether the user is affected, say so plainly instead of guessing.",
  "Say 'unconfirmed' when an incident's confidence is 'unconfirmed'."
 ],
 "incident": {
  "id": "office-word-attacked-bug-feb-2026",
  "url": "https://patchgap.ai/incidents/office-word-attacked-bug-feb-2026/",
  "path": "/incidents/office-word-attacked-bug-feb-2026/",
  "json_url": "https://patchgap.ai/incidents/office-word-attacked-bug-feb-2026.json",
  "title": "Microsoft Word: a bug that lets a bad document skip a safety check was used in real attacks",
  "category": "apps",
  "platforms": [
   "windows"
  ],
  "products": [
   "microsoft-office"
  ],
  "status": "patched",
  "status_label": "Patched: update now",
  "severity": "high",
  "severity_source": "Patch Gap rating: high, because CISA lists it as used in real attacks (we do not copy a score we have not checked).",
  "exploited_in_wild": "yes",
  "exploited_note": "CISA lists it as used in real attacks (added Feb 10, 2026). Microsoft marks it as exploited.",
  "exploited_source_url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
  "confidence": "confirmed",
  "confidence_note": null,
  "first_reported": "2026-02-10",
  "updated_at": "2026-10-27",
  "cves": [
   "CVE-2026-21514"
  ],
  "summary": "A bug in Microsoft Word lets a booby-trapped document get around a safety check. Microsoft fixed it in the February 2026 Office update.",
  "am_i_affected": "You are at risk if Word on your Windows PC has not updated since February 10, 2026.",
  "action": "Update Office (February 2026 update or newer)",
  "affected": [
   {
    "product": "microsoft-office",
    "product_name": "Microsoft Office (Word, Excel, Outlook, PowerPoint)",
    "platform": "windows",
    "affected_versions": "Microsoft Word / Office on Windows without the February 2026 update",
    "fixed_version": null,
    "fixed_min": null,
    "fix_note": "Fixed by Microsoft's February 2026 Office security update (Feb 10, 2026) or any newer update.",
    "fixed_source_urls": [
     "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21514"
    ],
    "check": {
     "menu_path": "Open Word (or Excel). Click File > Account > Update Options > Update Now. The version is shown under About Word.",
     "command": "(Get-ItemProperty 'HKLM:\\SOFTWARE\\Microsoft\\Office\\ClickToRun\\Configuration' -ErrorAction SilentlyContinue).VersionToReport",
     "shell": "PowerShell",
     "read_only": true
    },
    "official_download": "https://support.microsoft.com/office/install-office-updates-2ab296f3-7f03-43a2-8e50-46de917611c5"
   }
  ],
  "fix_steps": [
   "Open Word, Excel or any Office app.",
   "Click File > Account.",
   "Click Update Options > Update Now.",
   "Close all Office apps when asked so the update can finish."
  ],
  "official_patch_links": [
   {
    "label": "Microsoft: install Office updates",
    "url": "https://support.microsoft.com/office/install-office-updates-2ab296f3-7f03-43a2-8e50-46de917611c5"
   },
   {
    "label": "Microsoft: CVE-2026-21514 details",
    "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21514"
   }
  ],
  "extra_checks": [],
  "sources": [
   {
    "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21514",
    "title": "Microsoft Security Update Guide: CVE-2026-21514 (February 2026 update)",
    "date": "2026-02-10",
    "kind": "vendor",
    "official": true
   },
   {
    "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
    "title": "CISA: Known Exploited Vulnerabilities catalog entry for CVE-2026-21514 (added 2026-02-10)",
    "date": "2026-02-10",
    "kind": "cisa",
    "official": true
   },
   {
    "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-21514",
    "title": "NVD: CVE-2026-21514",
    "date": "2026-02-10",
    "kind": "nvd",
    "official": true
   }
  ]
 }
}