Skip to the content
The Update Bureau
Office Online Server OOS Office Online Server Security update
Patch Tuesday

KB5002707

KB5002707: Cumulative update for Office Online Server, version OOS, May 2025. Excel remote code execution flaw resolved

In short

Resolves a Microsoft Excel remote code execution vulnerability. It addresses seven vulnerabilities, all rated Important.

Does it affect you? Applies to: Computers with the release version of Office Online Server installed. The update package is for x64 systems and installs build 16.0.10417.20010.

Build
16.0.10417.20010
Security
7 fixed
Restart
Required

What changes

Fix 1 change

Excel

Verified in package

For: Office Online Server administrators

  • A Microsoft Excel remote code execution vulnerability is resolved.1

Improvement 1 change

Security update

For: Office Online Server administrators

  • This update replaces the previously released security update KB5002699.2

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2025-05-13
Classification
Security Updates
Type
Cumulative update
Restart
Required
Replaces
KB5002699, KB5002690, KB5002679, KB5002677
+3 earlier KB5002648, KB5002601, KB5002503
Replaced by
KB5002728
VersionBuildChannel
OOS 16.0.10417.20010 General availability

Security

7 vulnerabilities fixed
7 important
VulnerabilitySeverityCVSS
CVE-2025-29977
Microsoft Excel Remote Code Execution Vulnerability
 Important 7.8
CVE-2025-29979
Microsoft Excel Remote Code Execution Vulnerability
 Important 7.8
CVE-2025-30375
Microsoft Excel Remote Code Execution Vulnerability
 Important 7.8
CVE-2025-30376
Microsoft Excel Remote Code Execution Vulnerability
 Important 7.8
CVE-2025-30379
Microsoft Excel Remote Code Execution Vulnerability
 Important 7.8
CVE-2025-30381
Microsoft Excel Remote Code Execution Vulnerability
 Important 7.8
CVE-2025-30383
Microsoft Excel Remote Code Execution Vulnerability
 Important 7.8

Downloads (Microsoft Update Catalog)

Package OOS
1.0 GB
wacserver-x-none.cab Main update · KB5002707 SHA-1: 2e5cf371…eb5a18

Updated components

1,605 files changed since the previous update for the same versions.

Top changed componentsFiles
Office web apps369
PowerPoint324
Excel261
Document conversion74
Word50

Verified in package: changed files confirm Excel.

Sources

Updated
Cited passages from Microsoft's official notes (2)
  1. 1. This security update resolves a Microsoft Excel remote code execution vulnerability. support.microsoft.com
  2. 2. This security update replaces previously released security update 5002699. support.microsoft.com
Checked automatically: 8 of 8 checks passed, 2 quoted passages · compared with Microsoft's page on Oct 20, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: passed

A second AI read the text against the sources: correctness 4/5, clarity 5/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake