Loading story…
Microsoft has confirmed that Windows 11 cumulative update KB5095051 introduced a known issue that can stop Microsoft Office applications from opening when launched from certain third-party programs using OLE automation. Affected apps include Word, Excel, PowerPoint, Access, and other Office components, and the failure may occur silently with no error message. Reported impacted software includes CCH Engagement, Workpaper Manager, Dentrix, Softdent, and Zotero, creating workflow disruptions for organizations that rely on Office integration from external applications.
The issue affects fully updated systems running Windows 11 version 26H1 with OS Build 28000.2269, following updates released on or after June 9. Microsoft said a fix is in progress and will be delivered in a future Windows update, while advising users to open Office apps or documents directly as a temporary workaround; enterprise customers can also contact Microsoft Support for Business for an organization-wide mitigation. Separate reporting on the same update also noted a deployment risk tied to a missing boot.STL file in installation media that can trigger boot failures with error code 0xc0430001 during dynamic update deployment.
See real exploitation activity before you spend the cycle.
3 events from the most recent confirmed update back to the earliest known activity.
Microsoft reported the known issue affecting third-party applications such as CCH Engagement, Workpaper Manager, Dentrix, Softdent, and Zotero, and said a fix is in progress for a future Windows update. As interim guidance, Microsoft advised opening Office apps or documents directly and said organizations could contact Microsoft Support for Business for a workaround.
After Windows updates released on or after June 9, 2026, some fully updated Windows systems began experiencing a problem where certain third-party applications could not launch Microsoft Office apps or open Office documents via OLE automation. Affected Office products include Word, Excel, PowerPoint, Access, and others, sometimes failing silently without an error message.
Microsoft released the June 2026 Patch Tuesday cumulative update KB5095051 for Windows 11 version 26H1 (OS Build 28000.2269). The update later became associated with an Office launch compatibility issue affecting some third-party applications using OLE automation.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
3 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcebleepingcomputer.com
Open sourcesupport.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft released an out-of-band Windows 11 update, **KB5086672**, to fix a widespread installation failure affecting versions **25H2** and **24H2** after the March preview update **KB5079391** triggered repeated setup errors. Affected systems entered a loop of failed update attempts and reported error code `0x80073712`, which indicates missing or corrupted update files. Microsoft withdrew the faulty preview release and replaced it with a cumulative package that also carries forward March security and quality fixes. The emergency package moves impacted devices to OS builds **26200.8117** and **26100.8117** and also updates several local AI components. Microsoft said the fix is available through **Windows Update**, the **Microsoft Update Catalog**, and manual installation in Settings, while enterprise administrators can accelerate deployment through **Intune** or **Windows Autopatch** expedited quality updates. Because the release combines the servicing stack and cumulative update, rollback options are limited and manual removal may require **DISM**.
Jun 29, 2026
Microsoft confirmed that the Windows 11 cumulative update `KB5079473` is causing Microsoft account sign-in failures in several Microsoft applications, including **Teams, OneDrive, Edge, Excel, Word,** and **Microsoft 365 Copilot**. Affected users are shown a misleading message stating that the device is not connected to the Internet, even when connectivity is working, preventing normal sign-in activity across those services. The issue has been linked to a specific network connectivity state and appears to affect Windows 11 systems on versions **24H2** and **25H2** that use Microsoft accounts, while organizations authenticating with **Entra ID** are not impacted. Microsoft said it is developing a permanent fix and, in the meantime, recommends restarting affected PCs while they remain connected to the Internet, noting that the problem can return if a device is rebooted without an active connection.
Jun 29, 2026
Microsoft released **out-of-band (OOB) security updates** to address an actively exploited Microsoft Office zero-day, **CVE-2026-21509**, described as a **security feature bypass** caused by reliance on untrusted input in a security decision. The flaw impacts **Office 2016, Office 2019, Office LTSC 2021, Office LTSC 2024, and Microsoft 365 Apps for Enterprise**, and is exploited by sending a user a **malicious Office document** and convincing them to open it; Microsoft stated the **Preview Pane is not an attack vector**. The fix addresses a bypass of **OLE mitigations** intended to protect users from vulnerable **COM/OLE controls**, but Microsoft did not provide public technical details on the in-the-wild exploitation. For **Office 2021 and later / Microsoft 365 Apps**, Microsoft indicated protections may be applied via a **service-side fix** after restarting Office apps, while **Office 2016 and 2019** updates were not yet available at the time of reporting and were promised “as soon as possible.” As interim risk reduction, Microsoft provided mitigations that include a **Windows Registry** change to block vulnerable COM/OLE controls by adding a COM compatibility key and setting a `Compatibility Flags` DWORD value; guidance emphasized backing up the registry and restarting Office applications after applying the mitigation.
Jun 29, 2026