Microsoft has released an emergency patch to fix a zero-day security flaw in Office, CVE-2026-21509, that the company says has already been exploited in the wild and could let attackers bypass Office security to deliver a malicious document. Microsoft described the bug as a Microsoft Office Security Feature Bypass Vulnerability