Loading story…
Microsoft paused the optional KB5002907 update after reports that it deactivated legitimate perpetual-license Office 2016 and Office 2019 installations, causing applications to display “Unlicensed Product.” The update targeted systems running Microsoft 365 Apps more than 90 days behind on the Current Channel or Monthly Enterprise Channel, including some one-time-purchase Office Home & Business customers.
In rare cases, the update reportedly removed Office entirely; unconfirmed reports link failed reinstalls to systems combining 32-bit Office with 64-bit Microsoft Access Runtime. Microsoft is investigating and has halted the rollout. Affected users can try reactivating with the original product key or linked Microsoft account, while users whose Office installation was removed should download and reinstall their purchased version.
See real exploitation activity before you spend the cycle.
4 events from the most recent confirmed update back to the earliest known activity.
Reports surfaced that KB5002907 caused one-time-purchase Office 2016 and Office 2019 Home & Business installations to appear as unlicensed or, in some cases, be removed. Belgian MSP operator Christian Van Hautte reported five unrelated customers affecting dozens of PCs within about ten minutes; re-entering product keys restored activation on some systems.
Microsoft released KB5002907 through Windows Update for Microsoft 365 Apps installations on the Current Channel or Monthly Enterprise Channel that were more than 90 days out of date. The update was intended to let outdated installations resume updating and move to their assigned channel's current build.
Microsoft ended support for Office 2016 and Office 2019, while stating that customers could continue using the suites.
Microsoft acknowledged that KB5002907 could leave Office 2016 or Office 2019 appearing unlicensed or, rarely, remove it entirely, and paused the rollout while investigating. It advised affected customers to reactivate with their product key or linked Microsoft account, or reinstall their purchased Office copy if it was removed.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft has confirmed that Windows 11 cumulative update **KB5095051** introduced a known issue that can stop Microsoft Office applications from opening when launched from certain third-party programs using **OLE automation**. Affected apps include **Word, Excel, PowerPoint, Access**, and other Office components, and the failure may occur silently with no error message. Reported impacted software includes **CCH Engagement, Workpaper Manager, Dentrix, Softdent, and Zotero**, creating workflow disruptions for organizations that rely on Office integration from external applications. The issue affects fully updated systems running **Windows 11 version 26H1** with **OS Build `28000.2269`**, following updates released on or after June 9. Microsoft said a fix is in progress and will be delivered in a future Windows update, while advising users to open Office apps or documents directly as a temporary workaround; enterprise customers can also contact Microsoft Support for Business for an organization-wide mitigation. Separate reporting on the same update also noted a deployment risk tied to a missing **`boot.STL`** file in installation media that can trigger boot failures with error code **`0xc0430001`** during dynamic update deployment.
Jun 29, 2026
Microsoft released **out-of-band (OOB) security updates** to address an actively exploited Microsoft Office zero-day, **CVE-2026-21509**, described as a **security feature bypass** caused by reliance on untrusted input in a security decision. The flaw impacts **Office 2016, Office 2019, Office LTSC 2021, Office LTSC 2024, and Microsoft 365 Apps for Enterprise**, and is exploited by sending a user a **malicious Office document** and convincing them to open it; Microsoft stated the **Preview Pane is not an attack vector**. The fix addresses a bypass of **OLE mitigations** intended to protect users from vulnerable **COM/OLE controls**, but Microsoft did not provide public technical details on the in-the-wild exploitation. For **Office 2021 and later / Microsoft 365 Apps**, Microsoft indicated protections may be applied via a **service-side fix** after restarting Office apps, while **Office 2016 and 2019** updates were not yet available at the time of reporting and were promised “as soon as possible.” As interim risk reduction, Microsoft provided mitigations that include a **Windows Registry** change to block vulnerable COM/OLE controls by adding a COM compatibility key and setting a `Compatibility Flags` DWORD value; guidance emphasized backing up the registry and restarting Office applications after applying the mitigation.
Jun 29, 2026
Microsoft is dealing with administrator backlash over Windows update quality and lifecycle changes after cumulative update `KB5094126` reportedly broke Word OLE and COM-based integrations used by line-of-business applications including CCH Engagement, with sysadmins also citing impacts on Dentrix and SoftDent workflows. Separate reports tied the same update to missing taskbar clock and hidden system tray behavior on some Windows 11 systems, with community workarounds ranging from uninstalling the patch to registry edits and system repair steps, while one discussion said Microsoft planned a follow-up update to address the CCH Engagement Word COM plugin issue. At the same time, Microsoft clarified how Windows monthly releases, optional preview updates, hotpatching, and out-of-band fixes are delivered, while shipping Windows 10 ESU update `KB5099539` with Remote Desktop security hardening and OLE Automation fixes. The company also warned that Windows 11 24H2 Home and Pro will stop receiving updates on October 13, 2026, while Windows 10 remains widely deployed despite rising exposure as support windows narrow and ESU coverage remains temporary, increasing pressure on enterprises to modernize systems without disrupting critical application dependencies.
Jul 16, 2026