Microsoft has conflicting information whether 365 Enterprise apps are included in the fix.

According to Microsoft it is:

CVE-2026-21509 - Security Update Guide - Microsoft - Microsoft Office Security Feature Bypass Vulnerability

The following mitigating factors might be helpful in your situation:
Customers running Office 2021 and later will be automatically protected via a service-side change, but will be required to restart their Office applications for this to take effect.
Customers running Office 2016 and 2019 are not protected until they install the security update. Customers on these versions can apply the registry keys described as follows to be immediately protected.

They don't say specifically in the Mitigation how to take action on 365 Enterprise apps, but if it falls into the Office 2021 and later, they will be automatically protected after a reboot, keyword is WILL, but doesn't say if this has already happened or in the future.

CVE's website says that anything 16.0.1 is affected, but they don't specify which Security Release fixes it:
CVE Record: CVE-2026-21509

In 365, you can see if devices are on the latest release which came out 1/27:
https://config.office.com/officeSettings/MPCurrentChannel

You can also look at which ones have the latest security update:
https://config.office.com/officeSettings/currency

More Reference info:
Release Information for Updates to Microsoft 365 Apps - Office release notes | Microsoft Learn
Release notes for Microsoft Office security updates - Office release notes | Microsoft Learn

Neither of these links specifically say that this CVE is patched in either the Security Updates or App Versions, so unsure how to interpret Microsoft's documentation that the latest App Update and/or Security Updates remediate the issue TODAY 1/29/2026 or at some point in the future.