Overview

Microsoft has disclosed and patched an actively exploited zero-day vulnerability in Microsoft Office, tracked as CVE-2026-21509. The vulnerability allows attackers to bypass built-in Office security features when a user opens a specially crafted document, enabling follow-on malicious activity.

Microsoft issued an out-of-band (OOB) security update, and the vulnerability has been added to CISA’s Known Exploited Vulnerabilities (KEV) Catalog, confirming real-world exploitation.

This zero-day is especially dangerous because exploitation relies on social engineering, a technique commonly used in phishing campaigns targeting end users.

Vulnerability Details

What’s Happening?

The vulnerability allows a crafted Office document to bypass Office security controls, potentially allowing malicious content to execute or load without expected warnings or protections.

Attackers are leveraging this flaw in email-based phishing campaigns, making it particularly effective in environments without strong email security or user awareness training.

Affected Products

• Microsoft Office (multiple supported versions)
• Microsoft 365 Apps for Enterprise
• Microsoft 365 Apps for Business

⚠️ Any environment where users open Office documents from email or the internet should assume exposure until patched.

Indicators of Compromise (IOCs)

Microsoft has not released file hashes or IP addresses due to the evolving nature of the attacks. Detection is currently behavior-based.

Behavioral Indicators

• Office applications spawning unexpected child processes (e.g., cmd.exe, powershell.exe, mshta.exe)
• Office opening documents from email followed by network connections
• Office processes accessing unusual temporary directories
• Suspicious OLE or embedded object execution

SIEM Detection Queries

🔍 Splunk

index=windows EventCode=4688
ParentImage="*\\WINWORD.EXE" OR ParentImage="*\\EXCEL.EXE" OR ParentImage="*\\POWERPNT.EXE"
| search NewProcessName="*\\cmd.exe" OR NewProcessName="*\\powershell.exe" OR NewProcessName="*\\mshta.exe"
| table _time host User ParentImage NewProcessName CommandLine

🔍 Elastic (KQL)

process.parent.name : ("WINWORD.EXE","EXCEL.EXE","POWERPNT.EXE") and
process.name : ("cmd.exe","powershell.exe","mshta.exe")

🔍 Azure Sentinel (KQL)

SecurityEvent
| where EventID == 4688
| where ParentProcessName has_any ("WINWORD.EXE","EXCEL.EXE","POWERPNT.EXE")
| where NewProcessName has_any ("cmd.exe","powershell.exe","mshta.exe")
| project TimeGenerated, Computer, Account, ParentProcessName, NewProcessName, CommandLine

🔍 Wazuh

rule.groups:process_creation AND
process.parent.name:("WINWORD.EXE","EXCEL.EXE","POWERPNT.EXE") AND
process.name:("cmd.exe","powershell.exe","mshta.exe")

Mitigation & Remediation

✅ Immediate Actions

1. 1. Apply Microsoft’s out-of-band security update immediately
2. 2. Prioritize systems used for email and document handling
3. 3. Validate patch deployment via endpoint management tooling

🔒 Additional Hardening

• * Disable Office macros where not required
• * Enforce Protected View for internet-sourced documents
• * Strengthen email security filtering
• * Conduct user phishing awareness training

Why This Matters

This zero-day demonstrates a drecurring pattern:

• * User-driven attack vector
• * Trusted application abuse
• * Security control bypass
• * Rapid in-the-wild exploitation

Organizations in healthcare, financial services, and local government—especially those subject to HIPAA, GLBA, or NIST controls—should treat this vulnerability as high priority.

**UPDATE**

Your clients must be using the current channel within the click 2 run update settings to get this latest update. If you are currently using a semi update channel, you may not see the latest fix. The script below should check for the target version required to fix this vulnerability, change your settings to the current update channel and then force an update of the software. Note – This will force the applications to close on end users with no warning. The target version to fix this issue is 16.0.19628.20150.

Standard disclaimer – Use this code at your own risk and test it thoroughly. We are not able to test every scenario and every environment has unique settings we cannot account for.

<#
.SYNOPSIS
  Forces a Microsoft 365 Click-to-Run update only if installed build is below target.
  Temporarily pins Update Channel to Monthly Enterprise Channel (if needed), then reverts.

.LOGGING
  Writes to C:\Temp\OfficeC2R_ForceUpdate.log and to console.

.NOTES
  - Run elevated for best results.
  - Channel URL identifiers align to Microsoft's documented channel CDN GUIDs. :contentReference[oaicite:1]{index=1}
#>

# ----------------------------
# Config
# ----------------------------
$TargetVersionString    = "16.0.19628.20150"
$PostUpdateWaitMinutes  = 5          # "pause for several minutes"
$PollAfterWaitSeconds   = 120        # additional polling time after wait
$PollIntervalSeconds    = 15         # interval for polling VersionToReport
$LogDir                 = "C:\Temp"
$LogFile                = Join-Path $LogDir "OfficeC2R_ForceUpdate.log"

# Emergency channel pinning target:
# Monthly Enterprise Channel (often what orgs mean by "monthly" channel)
$MonthlyEnterpriseUrl = "http://officecdn.microsoft.com/pr/55336b82-a18d-4dd6-b5f6-9e5095c314a6"
$CurrentChannelUrl    = "http://officecdn.microsoft.com/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60"

# Choose which one you want to pin to for the emergency push:
# - "MonthlyEnterprise" -> $MonthlyEnterpriseUrl
# - "Current"           -> $CurrentChannelUrl
$EmergencyChannelName = "MonthlyEnterprise"
$EmergencyChannelUrl  = if ($EmergencyChannelName -eq "Current") { $CurrentChannelUrl } else { $MonthlyEnterpriseUrl }

# ----------------------------
# Helpers
# ----------------------------
function Write-Log {
    param(
        [Parameter(Mandatory=$true)][string]$Message,
        [ValidateSet("INFO","WARN","ERROR")][string]$Level = "INFO"
    )
    $ts = Get-Date -Format "yyyy-MM-dd HH:mm:ss"
    $line = "[$ts][$Level] $Message"
    Write-Output $line
    Add-Content -Path $LogFile -Value $line
}

function Ensure-LogPath {
    if (-not (Test-Path $LogDir)) {
        New-Item -Path $LogDir -ItemType Directory -Force | Out-Null
    }
    if (-not (Test-Path $LogFile)) {
        New-Item -Path $LogFile -ItemType File -Force | Out-Null
    }
}

function To-Version([string]$s) {
    try { return [version]$s } catch { return $null }
}

function Get-C2RConfig {
    $regPath = "HKLM:\SOFTWARE\Microsoft\Office\ClickToRun\Configuration"
    if (-not (Test-Path $regPath)) { return $null }
    try {
        return Get-ItemProperty -Path $regPath -ErrorAction Stop
    } catch {
        return $null
    }
}

function Get-C2RVersionString {
    $cfg = Get-C2RConfig
    if (-not $cfg) { return $null }
    $v = $cfg.VersionToReport
    if ([string]::IsNullOrWhiteSpace($v)) { return $null }
    return $v.Trim()
}

function Find-OfficeC2RClient {
    $candidates = @(
        Join-Path $env:ProgramFiles "Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe",
        Join-Path ${env:ProgramFiles(x86)} "Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe"
    )
    foreach ($p in $candidates) {
        if ($p -and (Test-Path $p)) { return $p }
    }
    return $null
}

function Set-C2RChannelUrls {
    param(
        [Parameter(Mandatory=$true)][string]$Url
    )
    $regPath = "HKLM:\SOFTWARE\Microsoft\Office\ClickToRun\Configuration"

    # We set both UpdateChannel and CDNBaseUrl because environments vary on which is honored/visible.
    New-Item -Path $regPath -Force | Out-Null
    Set-ItemProperty -Path $regPath -Name "UpdateChannel" -Value $Url -Type String -Force
    Set-ItemProperty -Path $regPath -Name "CDNBaseUrl"   -Value $Url -Type String -Force
}

function Invoke-C2RUpdate {
    param(
        [Parameter(Mandatory=$true)][string]$ClientPath
    )

    # Force update + close apps
    $args = "/update user forceappshutdown=true displaylevel=false"
    Write-Log "Running: `"$ClientPath`" $args"
    $p = Start-Process -FilePath $ClientPath -ArgumentList $args -Wait -PassThru -NoNewWindow
    Write-Log "OfficeC2RClient exit code: $($p.ExitCode)"
    return $p.ExitCode
}

function Wait-And-PollVersion {
    param(
        [Parameter(Mandatory=$true)][version]$TargetVersion
    )

    $sleepSeconds = [int]($PostUpdateWaitMinutes * 60)
    if ($sleepSeconds -gt 0) {
        Write-Log "Sleeping $PostUpdateWaitMinutes minute(s) to allow update to complete..."
        Start-Sleep -Seconds $sleepSeconds
    }

    $deadline = (Get-Date).AddSeconds($PollAfterWaitSeconds)
    do {
        $vStr = Get-C2RVersionString
        if ($vStr) {
            $v = To-Version $vStr
            Write-Log "Polled VersionToReport: $vStr"
            if ($v -and $v -ge $TargetVersion) {
                return $vStr
            }
        } else {
            Write-Log "Polled VersionToReport: <unavailable>" "WARN"
        }
        Start-Sleep -Seconds $PollIntervalSeconds
    } while ((Get-Date) -lt $deadline)

    return (Get-C2RVersionString)
}

# ----------------------------
# Main
# ----------------------------
Ensure-LogPath
Write-Log "=== Office C2R Emergency Update Start ==="
Write-Log "Target version: $TargetVersionString"
Write-Log "Emergency channel pin: $EmergencyChannelName ($EmergencyChannelUrl)"

$TargetVersion = To-Version $TargetVersionString
if (-not $TargetVersion) {
    Write-Log "Target version '$TargetVersionString' is not a valid version string." "ERROR"
    exit 2
}

$cfg = Get-C2RConfig
if (-not $cfg) {
    Write-Log "Click-to-Run registry path not found. Is Microsoft 365 Click-to-Run installed?" "ERROR"
    exit 1
}

$currentVersionString = Get-C2RVersionString
if (-not $currentVersionString) {
    Write-Log "Could not read VersionToReport from Click-to-Run configuration." "ERROR"
    exit 1
}

$currentVersion = To-Version $currentVersionString
Write-Log "Current VersionToReport: $currentVersionString"

# Capture existing channel settings (for revert)
$origUpdateChannel = $cfg.UpdateChannel
$origCdnBaseUrl    = $cfg.CDNBaseUrl
Write-Log ("Current UpdateChannel: " + ($(if ([string]::IsNullOrWhiteSpace($origUpdateChannel)) { "<null>" } else { $origUpdateChannel })))
Write-Log ("Current CDNBaseUrl:   " + ($(if ([string]::IsNullOrWhiteSpace($origCdnBaseUrl))    { "<null>" } else { $origCdnBaseUrl })))

if ($currentVersion -ge $TargetVersion) {
    Write-Log "Status: COMPLIANT (no update needed)"
    Write-Log "=== Office C2R Emergency Update End ==="
    exit 0
}

$client = Find-OfficeC2RClient
if (-not $client) {
    Write-Log "OfficeC2RClient.exe not found. Cannot trigger update." "ERROR"
    exit 1
}

# Decide whether we need to pin channel
$didChangeChannel = $false
$effectiveChannelNow = $origUpdateChannel
if ([string]::IsNullOrWhiteSpace($effectiveChannelNow)) { $effectiveChannelNow = $origCdnBaseUrl }

if ($effectiveChannelNow -ne $EmergencyChannelUrl) {
    Write-Log "Channel differs from emergency target. Pinning channel temporarily..."
    try {
        Set-C2RChannelUrls -Url $EmergencyChannelUrl
        $didChangeChannel = $true
        Write-Log "Pinned UpdateChannel/CDNBaseUrl to: $EmergencyChannelUrl"
    } catch {
        Write-Log "Failed to set channel registry values: $($_.Exception.Message)" "ERROR"
        exit 1
    }
} else {
    Write-Log "Channel already matches emergency target. No channel change required."
}

# Invoke update
Write-Log "Status: NON-COMPLIANT - triggering update with forced app shutdown."
$exitCode = Invoke-C2RUpdate -ClientPath $client

# Wait and poll
$finalVersionString = Wait-And-PollVersion -TargetVersion $TargetVersion
if (-not $finalVersionString) { $finalVersionString = "<unavailable>" }
Write-Log "Final VersionToReport:   $finalVersionString"

# Revert channel if we changed it
if ($didChangeChannel) {
    Write-Log "Reverting channel settings back to original values..."
    try {
        # Only revert values that originally existed; if null, remove them.
        $regPath = "HKLM:\SOFTWARE\Microsoft\Office\ClickToRun\Configuration"

        if ([string]::IsNullOrWhiteSpace($origUpdateChannel)) {
            Remove-ItemProperty -Path $regPath -Name "UpdateChannel" -ErrorAction SilentlyContinue
            Write-Log "Reverted UpdateChannel: removed (was originally null/empty)"
        } else {
            Set-ItemProperty -Path $regPath -Name "UpdateChannel" -Value $origUpdateChannel -Type String -Force
            Write-Log "Reverted UpdateChannel: $origUpdateChannel"
        }

        if ([string]::IsNullOrWhiteSpace($origCdnBaseUrl)) {
            Remove-ItemProperty -Path $regPath -Name "CDNBaseUrl" -ErrorAction SilentlyContinue
            Write-Log "Reverted CDNBaseUrl: removed (was originally null/empty)"
        } else {
            Set-ItemProperty -Path $regPath -Name "CDNBaseUrl" -Value $origCdnBaseUrl -Type String -Force
            Write-Log "Reverted CDNBaseUrl: $origCdnBaseUrl"
        }
    } catch {
        Write-Log "WARNING: Failed to revert channel values: $($_.Exception.Message)" "WARN"
    }
}

# Final compliance evaluation
$finalVerParsed = To-Version ($finalVersionString -replace '\s','')
if ($finalVerParsed -and $finalVerParsed -ge $TargetVersion) {
    Write-Log "Result: SUCCESS (now compliant with target >= $TargetVersionString)"
    Write-Log "=== Office C2R Emergency Update End ==="
    exit 0
}

Write-Log "Result: FAILURE (still below target $TargetVersionString). Review logs and consider longer wait/poll or confirm build availability on chosen channel." "ERROR"
Write-Log "=== Office C2R Emergency Update End ==="
exit 1

How DBT Helps

At DBT, we help organizations reduce risk from zero-days like this through:

• * Managed SIEM with proactive threat hunting
• * 24/7/365 MXDR response
• * Email security and phishing simulation
• * Patch and configuration management
• * Passwordless MFA to reduce credential-based follow-on attacks

Source

Microsoft Security Response Center (MSRC) – CVE-2026-21509
Emergency Out-of-Band Security Update for Microsoft Office

Disclaimer:
The information provided in this blog post, including vulnerability details, indicators of compromise (IOCs), detection logic, and sample SIEM queries, is intended for informational and educational purposes only.

While efforts have been made to ensure accuracy at the time of publication, threat activity, exploitation techniques, and vendor guidance may change without notice. Organizations should independently validate all information, test detection queries in a non-production or controlled environment, and tailor them to their specific infrastructure, log sources, and security controls.

Execution of detection queries, scripts, or other technical actions is performed at the reader’s own risk. The author and publisher assume no responsibility or liability for any errors, omissions, service disruptions, data loss, or security incidents that may result from the use or misuse of this information.

Readers are strongly encouraged to consult official vendor security advisories, engage qualified security professionals, and follow established change management and incident response procedures before implementing any remediation or detection activity.