內容說明

研究人員發現Microsoft Windows與Office存在5個高風險安全漏洞，類型包含安全功能繞過(Security Feature Bypass)漏洞(CVE-2026-21510。 本篇整理重點為 CVE-2026-21510、CVE-2026-21513、CVE-2026-21514、CVE-2026-21519、CVE-2026-21533。其中至少一項漏洞已被提及遭利用，校內若有使用相關平台，應優先盤點與修補。

影響平台

  • Microsoft 365 Apps for Enterprise for 32-bit Systems
  • Microsoft 365 Apps for Enterprise for 64-bit Systems
  • Microsoft Office LTSC 2021 for 32-bit editions
  • Microsoft Office LTSC 2021 for 64-bit editions
  • Microsoft Office LTSC 2024 for 32-bit editions
  • Microsoft Office LTSC 2024 for 64-bit editions
  • Microsoft Office LTSC for Mac 2021
  • Microsoft Office LTSC for Mac 2024
  • Windows 10 Version 1607 for 32-bit Systems
  • Windows 10 Version 1607 for x64-based Systems
  • Windows 10 Version 1809 for 32-bit Systems
  • Windows 10 Version 1809 for x64-based Systems
  • Windows 10 Version 21H2 for 32-bit Systems
  • Windows 10 Version 21H2 for ARM64-based Systems
  • Windows 10 Version 21H2 for x64-based Systems
  • Windows 10 Version 22H2 for 32-bit Systems
  • Windows 10 Version 22H2 for ARM64-based Systems
  • Windows 10 Version 22H2 for x64-based Systems
  • Windows 11 Version 23H2 for ARM64-based Systems
  • Windows 11 Version 23H2 for x64-based Systems
  • Windows 11 Version 24H2 for ARM64-based Systems
  • Windows 11 Version 24H2 for x64-based Systems
  • Windows 11 Version 25H2 for ARM64-based Systems
  • Windows 11 Version 25H2 for x64-based Systems
  • Windows 11 Version 26H1 for ARM64-based Systems
  • Windows 11 Version 26H1 for x64-based Systems
  • Windows Server 2012
  • Windows Server 2012(Server Core installation)
  • Windows Server 2012 R2
  • Windows Server 2012 R2(Server Core installation)
  • Windows Server 2016
  • Windows Server 2016(Server Core installation)
  • Windows Server 2019
  • Windows Server 2019(Server Core installation)
  • Windows Server 2022
  • Windows Server 2022(Server Core installation)
  • Windows Server 2022, 23H2 Edition(Server Core installation)
  • Windows Server 2025
  • Windows Server 2025(Server Core installation)

處置建議

  • 盤點校內是否使用受影響版本，包含自管、委外代管與專案環境。
  • 依官方或廠商公告套用修補版本；若短期無法更新，先限制管理介面來源並強化監控。
  • 檢查近期管理帳號登入、設定異動、異常腳本或未知管理操作紀錄。

CVE編號

  • CVE-2026-21510
  • CVE-2026-21513
  • CVE-2026-21514
  • CVE-2026-21519
  • CVE-2026-21533

參考資料