VulnRadar

Data against noise.

Built with NaN
Page generated: 09 Nov 2026, 11:41 UTC
← Dashboard

CVE-2026-21509

Reliance on untrusted inputs in a security decision in Microsoft Office allows an unauthorized attacker to bypass a security feature locally.

CVSS 7.8 (HIGH) KEV: KNOWN CATALOG

Attention and evidence

HYPE SCORE
0.0/10
REALITY · THREAT PRIORITY
8.5/10
General review priority; not probability

Evidence confidence: Exploitation recorded

Why this priority?
  • Recorded exploitation baseline: +7.00
  • Technical severity: CVSS 7.8: +1.17
  • Fresh EPSS: 70.80%: +0.35

General review priority, not probability, victim count or asset-specific risk. A range covers missing CVSS/EPSS inputs within the current evidence state.

Sources: 25 documents and public datasets.

Hype components

Headline sample (25%)
0/100
Press, 30 days (60%)
0/100
Grounded branding (15%)
0/100
HYPE TOTAL0/100

Sources and documents

Recorded Future
Press · 10 Jul 2026, 07:00 · June 2026 CVE Landscape - Recorded Future
Proofpoint
Press · 27 May 2026, 07:00 · More CVEs, Same Playbook: 2026 Vulnerability Exploitation in the Wild - Proofpoint
SOC Prime
Press · 12 Mar 2026, 07:00 · CVE-2026-21262: SQL Server Zero-Day Fixed in Microsoft’s March Patch Tuesday Release - SOC Prime
The Hacker News
Press · 02 Mar 2026, 08:00 · APT28 Tied to CVE-2026-21513 MSHTML 0-Day Exploited Before Feb 2026 Patch Tuesday - The Hacker News
Recorded Future
Press · 24 Feb 2026, 08:00 · January 2026 CVE Landscape: 23 Critical Vulnerabilities Mark 5% Increase, APT28 Exploits Microsoft Office Zero-Day - Recorded Future
See all 25 source documents
Arctic Wolf
Press · 10 Feb 2026, 08:00 · Microsoft Patch Tuesday: February 2026 - Arctic Wolf
Krebs on Security
Press · 10 Feb 2026, 08:00 · Patch Tuesday, February 2026 Edition - Krebs on Security
Redmondmag.com
Press · 04 Feb 2026, 08:00 · Russian Hackers Continue Exploiting Microsoft Office Zero-Day After Emergency Patch - Redmondmag.com
Trellix
Press · 04 Feb 2026, 08:00 · APT28’s Stealthy Multi-Stage Campaign Leveraging CVE‑2026‑21509 and Cloud C2 Infrastructure - Trellix
Help Net Security
Press · 03 Feb 2026, 08:00 · Russian hackers are exploiting recently patched Microsoft Office vulnerability (CVE-2026-21509) - Help Net Security
SOCRadar
Press · 03 Feb 2026, 08:00 · CVE-2026-21509: APT28 Actively Exploits Microsoft Office Vulnerability in Ukraine - SOCRadar
The Hacker News
Press · 03 Feb 2026, 08:00 · APT28 Uses Microsoft Office CVE-2026-21509 in Espionage-Focused Malware Attacks - The Hacker News
Infosecurity Magazine
Press · 02 Feb 2026, 08:00 · Fancy Bear Exploits Microsoft Office Flaw in Ukraine, EU Cyber-Attacks - Infosecurity Magazine
SOC Prime
Press · 02 Feb 2026, 08:00 · UAC-0001 (APT28) Attack Detection: russia-Backed Actor Actively Exploits CVE-2026-21509 Targeting Ukraine and the EU - SOC Prime
SOC Prime
Press · 02 Feb 2026, 08:00 · CVE-2026-21509 Exploited by APT28 via WebDAV and COM - SOC Prime
BleepingComputer
Press · 02 Feb 2026, 08:00 · Russian hackers exploit recently patched Microsoft Office bug in attacks - BleepingComputer
Cisco Talos Blog
Press · 29 Jan 2026, 08:00 · Microsoft releases update to address zero-day vulnerability in Microsoft Office - Cisco Talos Blog
SOC Prime
Press · 28 Jan 2026, 08:00 · CVE-2026-24858: FortiOS SSO Zero-Day Exploited in the Wild - SOC Prime
Help Net Security
Press · 27 Jan 2026, 08:00 · Microsoft reveals actively exploited Office zero-day, provides emergency fix (CVE-2026-21509) - Help Net Security
Dark Reading
Press · 27 Jan 2026, 08:00 · Microsoft Rushes Emergency Patch for Office Zero-Day - Dark Reading
SecurityWeek
Press · 27 Jan 2026, 08:00 · Microsoft Patches Office Zero-Day Likely Exploited in Targeted Attacks - SecurityWeek
Sophos
Press · 27 Jan 2026, 08:00 · Microsoft Office vulnerability (CVE-2026-21509) in active exploitation - Sophos
The Hacker News
Press · 27 Jan 2026, 08:00 · Microsoft Office Zero-Day (CVE-2026-21509) - Emergency Patch Issued for Active Exploitation - The Hacker News
SOC Prime
Press · 27 Jan 2026, 08:00 · CVE-2026-21509: Actively Exploited Microsoft Office Zero-Day Forces Emergency Patch - SOC Prime
Security Affairs
Press · 26 Jan 2026, 08:00 · Emergency Microsoft update fixes in-the-wild Office zero-day - Security Affairs

Score evolution

● Hype   ● Reality

Earlier evidence-support scores are retained in history; this chart shows only the current priority definition.

First record: hype 0.0 · reality 8.5 (2026-11-02 15:14). The curve appears once the score changes.

Public exploit evidence

2

Public exploit entries / repo candidates

See 2 repos with metrics
RepositoryStarsForksLanguageUpdated
gavz/CVE-2026-21509-PoC4215—28 Jan 2026, 20:33
DameDode/CVE-2026-21509-POC00Python12 Mar 2026, 20:43
Evidence context and dated references

Reality is general threat/review priority, combining observed exploitation, CVSS severity and fresh EPSS. Evidence confidence is separate. This is not calibrated risk, a victim count or an asset-specific assessment. A range reflects missing numeric inputs.

Evidence in context

Confidence in exploitation evidence
Exploitation recorded
Priority basis
Recorded exploitation; CVSS 7.8; EPSS 70.8%
Attention, last 30 days
0 distinct story titles; 0 press documents; 0 publisher domains.
Technical potential
local access, no prior privileges, user interaction.
Observed activity
Exploitation recorded in CISA KEV.
Known scale
Not quantified.
Evidence confidence basis
Trusted exploitation confirmation

Score evaluated: 2026-11-05 14:00:01.230559+00:00 · EPSS snapshot: 2026-11-05T12:03:04Z

Source event timeline
Added to the CISA KEV catalog
26 Jan 2026, 00:00
First press mention
26 Jan 2026, 08:00
Published
26 Jan 2026, 17:06
Latest press mention
10 Jul 2026, 07:00
Score calculated
05 Nov 2026, 14:00
PoCs on GitHub
2 repositories
Source: CVE List V5 · CISA KEV · FIRST EPSS · GitHub · RSSVulnRadar