Local Privilege Escalation Risk in Microsoft Office Word (CVE-2026-21514)

Historical catalog analysis: CISA added this entry on February 10, 2026. The entry reflects catalog information retrieved on August 31, 2026, not a snapshot archived on the inclusion date. Check current vendor guidance before acting.

What the vulnerability is

CVE-2026-21514 is a local privilege escalation vulnerability affecting Microsoft Office Word. The flaw stems from a reliance on untrusted inputs in a security decision (CWE-807). If exploited, an attacker who already has authorized access to a system could elevate their permissions locally.

Exposure and applicability

This vulnerability is particularly relevant for U.S. healthcare providers and business associates who utilize Microsoft Office Word for administrative tasks, patient documentation, or clinical reporting. Because the flaw allows for local privilege escalation, it represents a risk to the confidentiality and integrity of electronic Protected Health Information (ePHI) stored on or processed by affected workstations. An attacker with initial low-level access could potentially use this vulnerability to gain higher-level system permissions, increasing their ability to access restricted data or modify system configurations.

Remediation priorities

Based on our analysis, healthcare security leaders should prioritize the following actions to reduce the likelihood of exploitation:

1. Patch Management: Prioritize the application of vendor-supplied updates for Microsoft Office Word across all clinical and administrative workstations. This is the primary method to address the underlying vulnerability.
2. Principle of Least Privilege (PoLP): Review user account permissions on workstations that handle ePHI. Reducing the number of users with unnecessary administrative rights could limit the impact if a local privilege escalation attempt occurs.
3. Endpoint Hardening: Ensure that endpoint security controls are configured to detect and alert on unusual privilege changes or unauthorized attempts to modify system-level files.

How to validate remediation

To verify that exposure has been reduced, organizations should employ the following methods:

• Version Verification: Security teams can audit installed software versions across the fleet to ensure they match the patched versions specified in Microsoft’s update guide. While a version check does not guarantee total security, it confirms the patch has been deployed.
• Configuration Audit: Review system logs and account permission reports to verify that users are operating with the minimum necessary privileges required for their clinical or administrative roles.

Limits and open questions

It is currently unknown whether this vulnerability has been utilized in ransomware campaigns. Additionally, while CISA has established a remediation deadline of March 3, 2026, for federal agencies, this date is not a legal requirement for private healthcare providers, though it serves as a useful benchmark for risk management.

Organizations should note that patching the software addresses the specific flaw but does not eliminate the risk of initial access via other vectors. Residual risk remains if an attacker gains entry through phishing or compromised credentials before the patch is applied.

Source and editorial note

CVE-2026-21514: Microsoft Office Word Reliance on Untrusted Inputs in a Security Decision Vulnerability · Source date: February 10, 2026 · Retrieved August 31, 2026.

Material facts are tied to the cited primary source. Recommendations are independent defensive analysis unless attributed to the source. Confirm consequential decisions against current authoritative guidance.

Archive date: February 13, 2026. The displayed post date is assigned three days after the source date to organize this retrospective archive; it does not mean this site published the analysis then. First published by this site: September 18, 2026 at 01:53 UTC.

Request a healthcare security assessment