Cyber Resilience

CVE-2026-21514

Microsoft Office Long Term Servicing Channel 2021 … 2024

CISA KEVActive ExploitationEUVD Exploited
Published
10 February 2026
Modified
11 February 2026
KEV Added
10 February 2026
Patch / advisory
CVSS Score v3.1 7.8
Click a component to see what it means
Raw vectorCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS Score 0.015 72th percentile
Risk Priority 83 floored blend · peak EPSS

Summary

CVE-2026-21514 is a high-severity Reliance on Untrusted Inputs in a Security Decision (CWE-807) vulnerability in Microsoft Office Long Term Servicing Channel. Its CVSS base score is 7.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 28% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog.

The strongest mitigations our analysis identified map to AC-24 (Access Control Decisions) and SI-10 (Information Input Validation) — see the control section below for these in your framework.

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

CVE-2026-21514 is a vulnerability in Microsoft Office Word caused by reliance on untrusted inputs in a security decision, corresponding to CWE-807. Published on 2026-02-10, it enables an unauthorized attacker to bypass a security feature locally. The issue carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), indicating high severity due to substantial impacts on confidentiality, integrity, and availability.

Exploitation requires local access with low complexity and no privileges, but user interaction is necessary. An unauthorized attacker can leverage this to bypass security protections in Word, potentially leading to high-level compromise of the affected system given the elevated confidentiality, integrity, and availability impacts.

Microsoft's Security Response Center (MSRC) offers update guidance and mitigation details at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21514. The vulnerability is also referenced in CISA's Known Exploited Vulnerabilities Catalog at https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-21514.

OWASP Top 10 for Web (2025)

EU & UK References

Vulnerability Data

Reliance on untrusted inputs in a security decision in Microsoft Office Word allows an unauthorized attacker to bypass a security feature locally.

CWE(s)
KEV Date Added
10 February 2026

Related Threats

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1548 Abuse Elevation Control Mechanism Privilege Escalation
Adversaries may circumvent mechanisms designed to control privilege elevation to gain higher-level permissions.
T1556 Modify Authentication Process Defense Impairment
Adversaries may modify authentication mechanisms and processes to access user credentials or enable otherwise unwarranted access to accounts.
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2026-21509Same product: Microsoft 365 Appsboth on KEV
CVE-2023-21715Same product: Microsoft 365 Appsboth on KEV
CVE-2023-35311Same product: Microsoft 365 Appsboth on KEV
CVE-2023-36761Same product: Microsoft 365 Appsboth on KEV
CVE-2024-21384Same product: Microsoft 365 Apps
CVE-2024-26257Same product: Microsoft 365 Apps
CVE-2024-38172Same product: Microsoft 365 Apps
CVE-2024-21413Same product: Microsoft 365 Appsboth on KEV
CVE-2024-38189Same product: Microsoft 365 Appsboth on KEV
CVE-2024-38170Same product: Microsoft 365 Apps

Affected Assets

microsoft
365 apps
all versions
microsoft
office long term servicing channel
2021, 2024

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)

Detect
Catch it (NIST detect / respond)

Harden
Shrink the surface (DISA STIG)
  • 1 hardening rule · 1 OS baseline
Validate
Prove the fix (OWASP ASVS)

Mitigating Controls (NIST 800-53 r5) AI

Explicitly requires that every access decision be based on authoritative, protected decision data rather than caller-supplied inputs.

Input validation can reject malformed or attacker-controlled values before they reach a security decision point.

Access enforcement requires decisions to be made from trusted policy data rather than modifiable client-supplied inputs.

Information-flow enforcement applies rules to validated, internal attributes instead of untrusted external values.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.AA-03 mostly match
prevents

Strong authentication mechanisms directly prevent security decisions from depending on modifiable, untrusted inputs.

PR.AA-04 mostly match
prevents

Verification and protection of identity assertions stops reliance on attacker-controlled values for authorization decisions.

PR.AA-01 partial match
prevents

Proper management of identities/credentials reduces the chance that security decisions will be driven by untrusted inputs.

PR.AA-05 partial match
prevents

Policy-driven, least-privilege authorization reduces opportunities to bypass controls via tampered inputs.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

prevents

Secure coding standards directly prohibit using untrusted inputs for security-critical decisions.

finds

Security testing in development catches input-validation flaws before deployment.

finds

Monitoring can detect exploitation but does not stop the underlying weakness.

prevents

Application security requirements explicitly call for validation of inputs used in security decisions.

prevents

Secure architecture principles mandate treating all external inputs as untrusted.

prevents

Access-control rules can be bypassed if they rely on untrusted inputs.

References