Loading story…
Microsoft confirmed that Office security update KB5002914 can cause Microsoft Excel copy-and-paste actions to fail silently: the source cells remain selected, but no content appears at the destination and no error is displayed. The defect also disrupts formula dragging and autofill, affecting Excel 2016, 2019, 2021, and 2024 across MSI, Click-to-Run, and reported Office LTSC Standard 2021 deployments.
KB5002914 delivers fixes for Excel remote-code-execution and information-disclosure vulnerabilities, leaving organizations to weigh spreadsheet availability against retaining the September security protections. Microsoft has acknowledged the issue and is investigating, but has not provided a hotfix timeline; current mitigations are uninstalling the update on MSI installations or rolling back the Office build for Click-to-Run deployments.
See real exploitation activity before you spend the cycle.
4 events from the most recent confirmed update back to the earliest known activity.
Microsoft released KB5002914 for Excel 2016 as part of its September 2026 security updates. The update replaced KB5002886 and addressed Excel remote-code-execution and information-disclosure vulnerabilities.
Affected users reported that uninstalling KB5002914 from MSI installations or rolling back Click-to-Run Office builds restored Excel functionality. These mitigations remove the security improvements delivered by the September update.
Microsoft acknowledged the KB5002914 defect in its known-issues documentation and said it was investigating the problem. The issue was reported in MSI, Click-to-Run, and Office LTSC Standard 2021 deployments, with no error, beep, or other warning presented to affected users.
Following deployment of KB5002914, users reported that Excel copy-and-paste could fail silently, leaving the source selected and destination unchanged. Reports also described broken autofill and formula-dragging functions across Excel 2016, 2019, 2021, and 2024.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
5 references tracked. Mallory keeps watching after this page renders.
itpro.com
Open sourcecybersecuritynews.com
Open sourcecryptika.com
Open sourceghacks.net
Open sourcesupport.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft published security advisories for several **remote code execution** vulnerabilities affecting **Microsoft Office** and **Microsoft Excel**, including `CVE-2025-24057`, `CVE-2025-24075`, and `CVE-2025-47162`. The issues were listed in the Microsoft Security Update Guide as Office-family flaws that could allow arbitrary code execution if successfully exploited. The disclosures indicate that the affected attack surface spans both the broader Office suite and Excel specifically, underscoring continued risk from malicious documents and content processed by productivity software. Organizations using Microsoft Office should prioritize review of the relevant advisories and deployment of associated security updates for the affected products tied to these CVEs.
Jul 12, 2026
Microsoft published a long series of security advisories for **remote code execution** vulnerabilities affecting core Office components, with the largest concentration in **Excel** and **Word**. The disclosures include Excel flaws such as `CVE-2024-49026`, `CVE-2024-49069`, `CVE-2025-21362`, `CVE-2025-21381`, `CVE-2025-21387`, `CVE-2025-24082`, `CVE-2025-62553`, `CVE-2026-26107`, `CVE-2026-26109`, `CVE-2026-26112`, and `CVE-2026-40359`, alongside Word issues including `CVE-2025-24077`, `CVE-2025-24078`, `CVE-2025-47170`, `CVE-2025-49700`, `CVE-2025-59222`, `CVE-2026-23657`, and `CVE-2026-33095`. Microsoft also listed related RCE bugs in **Microsoft Office** (`CVE-2025-21392`), **PowerPoint** (`CVE-2025-54908`), **Inbox COM Objects (Global Memory)** (`CVE-2025-58730`), and the **Visual Studio Code Python Extension** (`CVE-2025-49714`). One of the few entries with technical detail, **`CVE-2026-40359`**, describes an **Important** Excel use-after-free flaw (`CWE-416`) with a **CVSS 3.1 score of 7.8** that can let an attacker execute code if a user opens a malicious Office file. Microsoft said the bug was **not publicly disclosed**, **not exploited in the wild**, and **less likely** to be exploited at the time of publication, adding that the **Preview Pane is not an attack vector** and that a fix is available. Taken together, the advisories show Microsoft continuing to address document-driven code execution risks across Office products, where successful exploitation generally depends on **user interaction with crafted files** rather than direct network exposure.
Jun 29, 2026
Microsoft’s March Patch Tuesday release fixed roughly **80+ vulnerabilities**, including a **critical** Microsoft Excel information disclosure flaw tracked as **CVE-2026-26144**. The issue is described as a cross-site scripting (XSS) condition that can be exploited in a **zero-click** scenario to trigger **Copilot Agent mode** to exfiltrate data via unintended network egress, creating a path for silent theft of sensitive information commonly stored in spreadsheets (e.g., financials, IP, operational records). Reporting noted the exploit requires **network access** but does **not** require user interaction or privilege escalation. Security guidance emphasized prioritizing patch deployment for CVE-2026-26144 and, where patching must be delayed, reducing exposure by constraining outbound connectivity and watching for anomalous Excel-initiated traffic. Suggested mitigations included restricting outbound network traffic from Office applications, monitoring unusual network requests generated by Excel processes, and disabling or limiting *Copilot Agent* until the fix is applied. Separate high-priority fixes highlighted in the same Patch Tuesday cycle included **SQL Server elevation of privilege** (**CVE-2026-21262**) and a **.NET denial-of-service** issue (**CVE-2026-26127**).
Jun 29, 2026