In an advisory issued by the Computer Emergency Readiness and Response Team Nigeria, the agency said Microsoft released out-of-band security updates to fix the flaw, tracked as CVE-2026-21509.

The vulnerability carries a CVSS score of 7.8 and is already being exploited.

Microsoft confirmed the issue allows attackers to bypass security protections in Office by getting a user to open a specially crafted document. The attack requires user interaction. However, the Preview Pane is not considered an attack path.

According to the advisory, the flaw bypasses Object Linking and Embedding protections designed to shield users from vulnerable COM/ OLE controls.

If exploited, it can allow malicious code to run, enable further compromise of a system, and increase the risk of malware delivery, data theft or lateral movement within an organisation.

Several versions of Microsoft Office are affected. These include Office 2016, both 32-bit and 64-bit editions, Office 2019 in 32-bit and 64-bit versions, Microsoft 365 Apps, and Office 2021 and later releases.

Microsoft noted: “Office 2021 and later versions are automatically protected through a service-side mitigation, but users must restart their Office applications for the protection to take effect.”

For Office 2016 and 2019, users should install the latest out-of-band security updates without delay. Those running Office 2021 and newer versions need to restart their applications to activate the service-side protection.

Where organisations cannot apply updates immediately, the advisory recommends implementing a registry-based mitigation and maintaining general security hygiene.

The agency also advised organisations to educate staff on the risks of opening unsolicited or unexpected Office documents. It further urged the use of endpoint protection and email filtering tools, while calling for close monitoring of systems for suspicious Microsoft Office-related activity.

Given that exploitation has already been confirmed, the agency said immediate action is necessary to reduce exposure.

What happened instead is a lack of clarity in Microsoft’s rebranding. Over the past week, reports have spread across Reddit, Hacker News and X saying that Microsoft Office has been renamed “Microsoft 365 Copilot”. It sounds believable, but it is also wrong.

Gareth Oystryk, senior director of Marketing, Microsoft 365, clarified: “We have not made any recent naming changes to our Office apps. Word, Excel, and PowerPoint, the Office apps within the Microsoft 365 productivity suite, remain unchanged.

In November 2022, we renamed only the Office “hub” app for web and mobile to the Microsoft 365 app. In January 2025, we updated it to the Microsoft 365 Copilot app to reflect its role in bringing Copilot and Microsoft 365 productivity experiences together in one place.”

The source of the confusion was that Office.com redirected users towards what Microsoft calls the Microsoft 365 Copilot app. 

This is not a new office suite, it’s a hub. One place to open Word, Excel, PowerPoint and Outlook, alongside Copilot features, under a single banner.

Microsoft set this path years ago. In 2022, the company dropped the Office name at the brand level and replaced it with Microsoft 365. The familiar apps never disappeared. What changed was the wrapper around them. 

Then, as Copilot became central to Microsoft’s pitch, the old Office app was renamed again, this time as the Microsoft 365 Copilot app.

That is where the language tripped people up. On Microsoft’s own site, users are greeted with the line: “The Microsoft 365 Copilot app (formerly Office)…”. Read quickly, it looks final, almost like an end notice for Office itself. That single phrase was enough to birth the idea that Office had been fully replaced.

It has not. Word is still Word. Excel still opens spreadsheets. PowerPoint still builds slides. Businesses and individuals can even buy Office 2024 as a standalone package, without cloud tools and without Copilot. That option alone should settle the case.

The timing made things worse. Microsoft has recently pushed the Copilot name harder than ever, positioning it as the front door to productivity. Office.com now reiterates that message. The result is a blurred line between the apps people use every day and the hub Microsoft wants them to launch from.

What surprises me is not that users are confused, but that Microsoft seems surprised by the reaction. So far, the company has not publicly stepped in to clear the air. Silence, in this case, has allowed assumptions to do the talking.

There are risks here. Some users now believe Office no longer exists. Others assume Copilot is mandatory or that familiar tools are being phased out. For businesses, especially cautious ones, that kind of uncertainty slows decisions and feeds distrust.

This episode is about unclear messaging layered on top of years of background rebrands. Microsoft may see Microsoft 365 Copilot as a neat, unified story. Many users see something else entirely, a once-simple product family wrapped in names that no longer explain themselves.

Office, whatever Microsoft chooses to call it at the top level, is still very much alive. The problem is that Microsoft’s own words have made that harder to see.