Back to the CVE list
CVE-2026-21509 CISA KEV · Actively exploited

Microsoft Office Security Feature Bypass Vulnerability

CVSS score

7.8

EPSS probability

%70.8

Risk score

11.0

Published

9 mo ago

OverviewPublic Exploits (14)NewsroomVulnerability Timeline

Public Exploits · GitHub and Metasploit Intelligence

This tab scans the sources that NVD labels as exploits, GitHub repositories matching the CVE identifier and Rapid7 Metasploit Framework modules. Only links to sources that were actually found are shown.

G
SimoesCTT/CTT-NFS-Vortex-RCE
GitHub

New Physics Disclosure This repository contains a full weaponized exploit for **CVE-2026-21509**, targeting the Windows Network File System (NFSv4.1) kernel-mode driver (`nfssvr.sys`). (★1)

Public PoCSource updated: 31.01.2026 14:38:05
G
decalage2/detect_CVE-2026-21509
GitHub

YARA rule and python script to detect potential exploits for the CVE-2026-21509 vulnerability in MS Office (★1)

Public PoCSource updated: 05.02.2026 01:37:13
G
Ashwesker/Ashwesker-CVE-2026-21509
GitHub

CVE-2026-21509 (★0)

Public PoCSource updated: 27.01.2026 18:43:17
G
kimstars/Ashwesker-CVE-2026-21509
GitHub

CVE-2026-21509 (★0)

Public PoCSource updated: 27.01.2026 21:03:20
G
nicole2ilodl/CVE-2026-21509-PoC
GitHub

CVE-2026-21509 (★0)

Public PoCSource updated: 27.01.2026 23:51:58
G
IncursioHack/CVE-2026-21509-PoC
GitHub

Educational PoC for CVE‑2026‑21509 (Microsoft Office security feature bypass). Generates a harmless DOCX with dummy OLE artifacts to study EDR/AV visibility. Not an exploit. For isolated labs only; see README for 7‑Zip inspection steps and mitigation references. (★0)

Public PoCSource updated: 29.01.2026 05:33:31
G
gavz/CVE-2026-21509-PoC
GitHub

Educational PoC for CVE‑2026‑21509 (Microsoft Office security feature bypass). Generates a harmless DOCX with dummy OLE artifacts to study EDR/AV visibility. Not an exploit. For isolated labs only; see README for 7‑Zip inspection steps and mitigation references. (★0)

Public PoCSource updated: 29.01.2026 09:51:19
G
ksk-itdk/KSK-ITDK-CVE-2026-21509-Mitigation
GitHub

Powershell script with Detection and Remediation for CVE-2026-21509 (★0)

Public PoCSource updated: 29.01.2026 20:49:07
G
SimoesCTT/CTT-MICROSOFT-OFFICE-OLE-MANIFOLD-BYPASS-CVE-2026-21509
GitHub

CVE-2026-21509 is a critical bypass in the Microsoft Office OLE (Object Linking and Embedding) validation engine. While standard "laminar" exploits attempt to manipulate static COM objects, this repository utilizes Theorem 4.2 to achieve a speculative race-condition bypass of the Object Definition Rule (ODR). (★0)

Public PoCSource updated: 02.02.2026 02:41:32
G
planetoid/cve-2026-21509-mitigation
GitHub

CVE-2026-21509 Mitigation (★0)

Public PoCSource updated: 11.02.2026 19:22:45
G
suuhm/CVE-2026-21509-handler
GitHub

PowerShell script to check, apply, and test the Kill-Bit protection for the CVE-2026-21509 Microsoft Office zero-day vulnerability affecting Office 2016/2019/LTSC. (★0)

Public PoCSource updated: 02.03.2026 02:16:00
G
DameDode/CVE-2026-21509-POC
GitHub

POC for the Office vulnerability (★0)

Public PoCSource updated: 13.03.2026 05:43:28
G
sentinel-aidefense/CVE-2026-21509
GitHub

CVE-2026-21509 Research writeup (★0)

Public PoCSource updated: 13.07.2026 20:49:52
G
razureink/cve-2026-21509-office_security_bypass_reproduction
GitHub

CVE Reproduction: cve-2026-21509-office_security_bypass_reproduction (★0)

Public PoCSource updated: 23.07.2026 12:46:38

Similar Vulnerabilities

Get this vulnerability through the API

Affected products, version ranges, exploitation status and patch information in a single request, with a free key.

Get a free keyDocumentation
curl -H "x-api-key: $DAYBREACH_API_KEY" \
  "https://api.daybreach.dev/api/v1/intel/cves/CVE-2026-21509"