CVE-2009-0238

CVE-2009-0238 is a Remote Code Execution vulnerability in Microsoft Office, originally disclosed in 2009, that was added to the CISA Known Exploited Vulnerabilities catalogue on 14 April 2026 as actively exploited in the wild. The vulnerability operates through macro-based attack chains and remains effective in approximately 30 per cent of unpatched legacy Office deployments, particularly in healthcare and the public sector where older software versions persist.

The CVE was patched by Microsoft in 2009 but persists in environments that have never applied the fix or that run versions of Office predating modern update mechanisms. Its reactivation in 2026 reflects a documented attacker behaviour: mining older CVE databases for vulnerabilities that remain exploitable in specific legacy-software populations. The macro execution path is simple and does not require sophisticated exploitation capability, making it accessible to a wide range of threat actors.

For public-sector CIOs and healthcare IT leaders, CVE-2009-0238's KEV addition is a board-level consequence: legacy Office estate is now a KEV compliance obligation, not a technical-debt backlog item. Any FCEB agency with unpatched Office deployments from that era has a mandatory remediation deadline. For private-sector organisations in scope of NCSC guidance, CISA's KEV addition provides the external evidence base for emergency upgrade prioritisation.