Microsoft Office 2021 support ends Oct 2026; SharePoint RCE vulnerability active

Microsoft announced that support for the desktop version of Office 2021 will cease on 13 October 2026. After that date the software will continue to run but will receive no technical assistance, bug fixes or security patches, leaving it vulnerable to exploits. No extended‑security program will be offered, and Microsoft urges users to move to Office 2024 or a Microsoft 365 subscription, or to consider alternative suites.

In addition, Microsoft will stop providing security updates for Office and Microsoft‑365 versions obtained through the Microsoft Store starting in December 2026, after functional updates already ended in October 2025. Organizations are advised to transition to the Click‑to‑Run deployment model using the Office Deployment Tool to maintain ongoing protection.

Separately, a critical remote‑code‑execution flaw (CVE‑2026‑45659) in SharePoint Server has been actively exploited by the “Storm‑2603” group. The vulnerability, rated 8.8 CVSS, affects SharePoint Server 2016, 2019 and the Subscription Edition. Patches (KB5002863, KB5002870, KB5002868) were released, with a US CISA remediation deadline of 4 July 2026. Administrators must apply the updates and follow post‑install steps to close the attack vector.