---
title: Microsoft Rushes Emergency Patch for Office Zero-Day Under Active Attack
description: Microsoft issues urgent patch for a zero-day Office vulnerability, CVE-2026-21509, to thwart ongoing hacker exploits.
canonical_url: https://codekeeper.co/ticker/microsoft-patches-office-zero-day-vulnerability
---

# Microsoft Rushes Emergency Patch for Office Zero-Day Under Active Attack

Microsoft issues urgent patch for a zero-day Office vulnerability, CVE-2026-21509, to thwart ongoing hacker exploits.

![Content Team](https://codekeeper.co/hubfs/_sized/Codekeeper_21_beeldmerkL-800.png)

By Content Team Jan 28, 2026

Share [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fmicrosoft-patches-office-zero-day-vulnerability%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fmicrosoft-patches-office-zero-day-vulnerability%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fmicrosoft-patches-office-zero-day-vulnerability%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fmicrosoft-patches-office-zero-day-vulnerability%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fmicrosoft-patches-office-zero-day-vulnerability%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fmicrosoft-patches-office-zero-day-vulnerability%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

ON THIS PAGE

### Want more insights like this?

Subscribe to our newsletter to get the latest software protection strategies delivered to your inbox.

By submitting your email, you consent to Codekeeper contacting you and agree to our [privacy policy](https://codekeeper.co/privacy-policy) .

Microsoft released an emergency patch for CVE-2026-21509, a zero-day vulnerability in Office and Microsoft 365 that attackers are actively exploiting. The bug allows hackers to bypass security controls and execute malicious code by tricking users into opening infected Office files. CISA added the vulnerability to its known exploited list, giving federal agencies until February 16 to patch or stop using affected products. Security experts believe this is likely a tool for advanced persistent threats, possibly state-sponsored groups targeting high-value victims through social engineering. Office 2021 users just need to restart their apps for automatic protection, while Office 2016 and 2019 users must install manual updates. **Source:** [Dark Reading](https://www.darkreading.com/vulnerabilities-threats/microsoft-rushes-emergency-patch-office-zero-day)

Share this article [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fmicrosoft-patches-office-zero-day-vulnerability%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fmicrosoft-patches-office-zero-day-vulnerability%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fmicrosoft-patches-office-zero-day-vulnerability%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fmicrosoft-patches-office-zero-day-vulnerability%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fmicrosoft-patches-office-zero-day-vulnerability%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fmicrosoft-patches-office-zero-day-vulnerability%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

![blog_book_a_demo_cta_3x](https://codekeeper.co/hubfs/_sized/Codekeeper%202025/blog_book_a_demo_cta_3x-768x512.webp)

Have questions about protecting your software?

Our escrow experts are standing by to help.

[Book a free demo](https://codekeeper.co/book-a-demo)

YOU MAY ALSO LIKE

[Sheffield Hospitals Charity Supporters Hit in Beacon CRM Data Breach Aug 11, 2026](https://codekeeper.co/ticker/sheffield-hospitals-charity-data-breach-alert)

[Cyberattacks Trivy Compromise, Not LiteLLM, Drove Most of the March Supply Chain Exposure Aug 17, 2026](https://codekeeper.co/ticker/trivy-scanner-supply-chain-attack-impact)

[Cyberattacks Silver Fox-Linked Hackers Are Using Fake Software Installers to Blind Windows Defender Sep 2, 2026](https://codekeeper.co/ticker/silver-fox-fake-software-campaign)

[Japan's Military Unknowingly Used Chinese Malware-Infected USB Drives for Nearly a Year Aug 12, 2026](https://codekeeper.co/ticker/jgsdf-malware-infected-usb-drives-expose-classified-data)