Microsoft Office Security Feature Bypass (CVE-2026-21509)
Detects exploitation of CVE-2026-21509, a security feature bypass vulnerability in Microsoft Office classified under CWE-807 (Reliance on Untrusted Inputs in a Security Decision). This vulnerability is actively exploited in the wild (CISA KEV) and allows attackers to bypass security controls within Office applications, potentially enabling malicious document execution without expected security warnings or Protected View enforcement.
Vulnerability Intelligence
KEV — Known ExploitedAffected Software
- Vendor
- Microsoft
- Product
- Office
Weakness (CWE)
Timeline
- Disclosed
- January 26, 2026
References & Proof of Concept
CVSS
What is CVE-2026-21509 Microsoft Office Security Feature Bypass (CVE-2026-21509)?
Microsoft Office Security Feature Bypass (CVE-2026-21509) (CVE-2026-21509) maps to the Initial Access and Defense Evasion tactics — the adversary is trying to get into your network in MITRE ATT&CK.
This page provides production-ready detection logic for Microsoft Office Security Feature Bypass (CVE-2026-21509), covering the data sources and telemetry it touches: Microsoft Defender for Endpoint, Microsoft Sentinel, Windows Security Events. The queries below are rated high severity at medium confidence, and ship for 7 SIEM platforms — KQL, SPL, Elastic, QRadar, Sumo, YARA-L, LogScale.
MITRE ATT&CK
- Tactic
- Initial Access Defense Evasion
let timeWindow = 24h;
let suspiciousOfficeProcesses = dynamic(["WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE", "OUTLOOK.EXE", "MSPUB.EXE", "VISIO.EXE", "ONENOTE.EXE"]);
let suspiciousChildProcesses = dynamic(["cmd.exe", "powershell.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe", "certutil.exe", "bitsadmin.exe", "wmic.exe"]);
union DeviceProcessEvents, SecurityEvent
| where TimeGenerated >= ago(timeWindow)
| where (ActionType == "ProcessCreated" or EventID == 4688)
| extend ParentProcess = coalesce(InitiatingProcessFileName, ParentProcessName)
| extend ChildProcess = coalesce(FileName, NewProcessName)
| where ParentProcess in~ (suspiciousOfficeProcesses)
| where ChildProcess in~ (suspiciousChildProcesses)
| project TimeGenerated, DeviceName, AccountName, ParentProcess, ChildProcess, ProcessCommandLine, InitiatingProcessCommandLine, FolderPath
| union (
DeviceFileEvents
| where TimeGenerated >= ago(timeWindow)
| where InitiatingProcessFileName in~ (suspiciousOfficeProcesses)
| where FolderPath has_any ("\\Temp\\", "\\AppData\\Roaming\\", "\\AppData\\Local\\Temp\\")
| where FileName endswith ".exe" or FileName endswith ".dll" or FileName endswith ".ps1" or FileName endswith ".vbs"
| project TimeGenerated, DeviceName, AccountName = InitiatingProcessAccountName, ParentProcess = InitiatingProcessFileName, ChildProcess = FileName, ProcessCommandLine = InitiatingProcessCommandLine, InitiatingProcessCommandLine, FolderPath
)
| union (
DeviceRegistryEvents
| where TimeGenerated >= ago(timeWindow)
| where InitiatingProcessFileName in~ (suspiciousOfficeProcesses)
| where RegistryKey has_any ("DisableProtectedView", "MarkOfTheWeb", "TrustCenter", "Security")
| project TimeGenerated, DeviceName, AccountName = InitiatingProcessAccountName, ParentProcess = InitiatingProcessFileName, ChildProcess = RegistryKey, ProcessCommandLine = InitiatingProcessCommandLine, InitiatingProcessCommandLine, FolderPath = RegistryKey
)
| summarize Count = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by DeviceName, AccountName, ParentProcess, ChildProcess
| where Count >= 1
| extend AlertSeverity = "High"
| extend CVE = "CVE-2026-21509"Detects Microsoft Office spawning suspicious child processes or writing executable content to temp directories, indicative of CVE-2026-21509 security feature bypass exploitation. Also monitors registry changes to Office trust/security keys initiated by Office processes.
Data Sources
Required Tables
False Positives
- Legitimate macro-enabled Office documents used in business workflows that spawn approved scripts
- IT automation tools using Office COM objects to generate reports via PowerShell
- Third-party Office add-ins that legitimately write temporary executable content
- Developer environments testing Office automation pipelines
Sigma rule & cross-platform mapping
The detection logic for Microsoft Office Security Feature Bypass (CVE-2026-21509) (CVE-2026-21509) above is provided in a vendor-neutral
form so you can deploy it on any SIEM. The same logic is shipped here as native
KQL (Microsoft Sentinel / Defender), SPL (Splunk), Elastic (Elastic Security (EQL)), QRadar (IBM QRadar (AQL)), Sumo (Sumo Logic CSE), YARA-L (Google Chronicle / SecOps), LogScale (CrowdStrike LogScale (CQL)) queries. In Sigma terms, this detection targets the
following logsource:
logsource:
category: process_creation
product: windowsBrowse the community-maintained Sigma rules for this technique:
Platform-specific guides for CVE-2026-21509
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Office Protected View Bypass via Registry Modification
Expected signal: Registry write events (Sysmon EventID 13) targeting HKCU\Software\Microsoft\Office\16.0\Word\Security with values DisableProtectedView and VBAWarnings modified
- Test 2Office Spawning PowerShell Child Process
Expected signal: Sysmon EventID 1 / Windows EventID 4688 showing WINWORD.EXE as ParentImage and powershell.exe as child Image with encoded or suspicious command-line arguments
- Test 3Office Dropping Executable to Temp Directory
Expected signal: Sysmon EventID 11 (FileCreate) showing an .exe file written to %TEMP% by an Office-related initiating process; DeviceFileEvents in MDE with InitiatingProcessFileName matching an Office executable
Unlock Pro Content
Get the full detection package for CVE-2026-21509 including response playbook, investigation guide, and atomic red team tests.