128: Microsoft Issues Multiple Out-Of-Band Updates in January 2026: Critical Office Vulnerability (CVE-2026-21509) Demands Immediate Action

Microsoft has issued three out-of-band updates in January 2026, a rare break from its usual Patch Tuesday schedule due to pressing threats. The most critical is CVE-2026-21509, a Microsoft Office vulnerability being actively exploited. Organisations should accelerate testing and deployment of these patches, prioritising protection of critical systems without skipping validation. Notify end users to minimise workflow disruptions and review Office macro permissions. Firms handling sensitive data or in high-profile sectors must act with urgency, as attackers target delays in patch deployment. These unexpected releases signal an increasingly dynamic threat landscape—remain vigilant with patching and cautious with email, even internal communications.

Microsoft Issues Multiple Out-Of-Band Updates in January 2026: Critical Office Vulnerability (CVE-2026-21509) Demands Immediate Action