Microsoft Office CVE-2026-21509: OLE security bypass patched out of band and used by APT28 within days

What happened

On 26 January 2026, Microsoft released an out-of-band fix for CVE-2026-21509, a security feature bypass in Office. Microsoft says it “bypasses OLE mitigations in Microsoft 365 and Microsoft Office which protect users from vulnerable COM/OLE controls”. An attacker must send a user a malicious Office file and get them to open it. The Preview Pane is not an attack vector. It is rated CVSS 7.8, and Microsoft marked it as exploited, not publicly disclosed (MSRC).

Microsoft fixed it in two ways (MSRC):

• Microsoft 365 Apps, Office 2021 and later: protected by a service-side change. Users must restart their Office applications for it to take effect.
• Office 2016 and 2019: protected only after installing the security update. Microsoft first said those updates were still to come, then made them available on 26 January as builds 16.0.5539.1001 (Office 2016) and 16.0.10417.20095 (Office 2019).

CISA added the CVE to its Known Exploited Vulnerabilities catalog the same day, with a federal deadline of 16 February (CISA KEV).

APT28 moved fast. Zscaler ThreatLabz saw in-the-wild exploitation on 29 January 2026, about three days after the patch. It attributed the campaign, which it named “Operation Neusploit”, to APT28 (Fancy Bear), a group linked to Russia’s GRU. Victims in Central and Eastern Europe, including Ukraine, Slovakia and Romania, received emails with crafted RTF attachments. Opening the file made Office download a dropper DLL. The server only returned the DLL to requests from the target region with the expected User-Agent. Two payload paths followed (CSO Online):

• MiniDoor, a DLL that changes registry settings to weaken Outlook security controls and steals email.
• PixyNetLoader, which persists through DLL proxying and COM object hijacking and installs a Covenant Grunt implant that talks to cloud-hosted command and control.

Am I affected?

You are affected if any Windows machine runs Office 2016 or 2019 below the fixed builds, or runs Microsoft 365 Apps or Office 2021 or later and has not restarted its Office apps since 26 January 2026.

To check a single machine, open any Office app, then File > Account > About. The top line shows the build (MSRC). From PowerShell:

# Click-to-Run installs (Microsoft 365 Apps, Office 2019/2021/2024 retail)
Get-ItemProperty HKLM:\SOFTWARE\Microsoft\Office\ClickToRun\Configuration |
  Select-Object VersionToReport, Platform

# MSI installs of Office 2016: file version of Word
(Get-Item "C:\Program Files\Microsoft Office\Office16\WINWORD.EXE").VersionInfo.FileVersion
(Get-Item "C:\Program Files (x86)\Microsoft Office\Office16\WINWORD.EXE").VersionInfo.FileVersion

At fleet scale, report on Office build numbers from your patch tool, and on Office processes that have been running since before 26 January 2026.

What to do now

1. Install the Office 2016 and 2019 updates from 26 January 2026 (builds 16.0.5539.1001 and 16.0.10417.20095 or later).
2. Force Office apps to restart on Microsoft 365 Apps and Office 2021 or later. Long-running Outlook and Word sessions do not pick up the service-side fix until they are closed.
3. If you cannot patch Office 2016 or 2019 yet, Microsoft’s page documents a registry block: under the COM Compatibility key for your Office install, add the subkey {EAB22AC3-30C1-11CF-A7EB-0000C05BAE0B} with a REG_DWORD named Compatibility Flags set to 400 (hex). The page lists the exact key path for MSI and Click-to-Run, 32-bit and 64-bit. A later mitigation note on the same page says registry keys do not apply to Office 2016 or 2019, so treat this only as a stopgap and install the update (MSRC).
4. Hunt for the APT28 chain if you have staff or partners in the region Zscaler described. Look for RTF attachments received from late January 2026 onward, Office processes (WINWORD.EXE, OUTLOOK.EXE) fetching a DLL over HTTP shortly after a document opened, unexpected changes to Outlook security registry settings, and new COM object registrations under user profiles (CSO Online). Zscaler published hashes, domains and URLs; the CSO article does not reproduce them.

Sources

• Microsoft Security Response Center: CVE-2026-21509
• CVE record: CVE-2026-21509
• CSO Online: APT28 exploits Microsoft Office vulnerability in spear-phishing campaign
• CISA Known Exploited Vulnerabilities catalog