Vulnerabilities · 182 days ago

Microsoft Word OLE Bypass Exposes Nearly 14 Million Assets

Tenable One telemetry shows nearly 14 million vulnerable assets across seven Tier‑1 countries; the count is a lower‑bound estimate.

CVE-2026-21514

NVD KEV

Known exploited · CISA KEV

CVSS 7.8 HIGH: reliance on untrusted inputs in a security decision in Microsoft Office Word allows an unauthorized attacker to… EPSS 2% (73rd percentile). Microsoft patch: Click to Run.

CISA federal remediation date Mar 3 · date passed

Timeline

Mar 17 Reported by Tenable
Mar 3 CISA federal deadline for CVE-2026-21514 passed
Feb 10 CVE-2026-21514 added to CISA KEV

Sources

1 source covering this story

Tenable Mar 17
CVE-2026-21514 FAQ: OLE bypass N-Day in Microsoft Word | Tenable®
The OLE bypass N-day vulnerability (CVE-2026-21514) in Microsoft Word exposes nearly 14 million assets.

Entities

CVE-2026-21514

Vendor digest: Microsoft

Part of the PlainSec briefing for 2026-03-18

Editions

Briefing for 2026-03-18