Microsoft issues emergency Office fix amid exploitation

Microsoft issued an out-of-band security advisory for Office vulnerability CVE-2026-21509 on 26 January. Canada’s Cyber Centre said Microsoft had received exploitation reports and that CISA added the vulnerability to its Known Exploited Vulnerabilities catalogue the same day. The official Canadian advisory distinguishes this emergency response from Microsoft’s regular 13 January updates.

The immediate issue was a security feature bypass. Microsoft’s Office 2016 support page identifies KB5002713 as an update resolving that vulnerability in Word. A security feature bypass concerns a protection failing to enforce its intended boundary; the support notice does not provide evidence that every Office installation had been compromised.

The KB5002713 notice makes an important deployment distinction: the package in the Download Center applies to Microsoft Installer editions of Office 2016, rather than Click-to-Run editions. Administrators therefore needed to identify the installed edition before choosing an update package.

Microsoft listed automatic delivery through Microsoft Update, a standalone package through the Update Catalog, and a Download Center option. The update replaced KB5002573. Those instructions describe the Office 2016 package; they should not be read as universal installation steps for newer Office releases. The Cyber Centre directed users and administrators to review Microsoft’s security guidance and apply the updates relevant to their systems. The Canadian advisory records actual exploitation reports, but it does not identify a single campaign or establish a total number of victims.