Exploited vulnerabilitiesBriefConfirmed by two or more outlets
Microsoft Office security-feature bypass (CVE-2026-21509)
Out-of-band patch 26 Jan 2026. KEV the same day.
- Disclosed
What happened
- Out-of-band patch 26 Jan 2026. KEV the same day. APT28 “Operation Neusploit” (Zscaler, CERT-UA). Weaponized within about 3 days.
Live scores
Live scores
CVE-2026-21509- EPSS
- 0.708
very likely to be attacked soon - VEDAS
- 0.977
strong exploit evidence - On CISA KEV
- Yes, since 2026-01-26
- Detection rule
- Out of scope (local)
Thin horizontal line: the “likely” (EPSS 0.10) or “strong” (VEDAS 0.90) threshold. Shaded “no data” areas are periods when cve-scores did not publish.
Sources
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21509
- https://www.csoonline.com/article/4127181/apt28-exploits-microsoft-office-vulnerability-in-spear-phishing-campaign.html
This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.