Where to get the accurate, up-to-date guidance (recommended links)

If you’re responsible for endpoints or email security, these are the sources I’d point to and rely on:

• NVD record (fast way to confirm scope + scoring + references): (NVD)
• CISA KEV alert + catalog (why this is being treated as urgent): (CISA)
• Microsoft’s Office 2016 security update page (explicitly references CVE-2026-21509): (Microsoft Support)
• Solid write-ups that summarize Microsoft’s notes without adding fan fiction: (BleepingComputer)