KB5002835: Cumulative update for Office Online Server, version OOS, February 2026. Excel data disclosure and privilege vulnerabilities addressed

The update resolves three Important vulnerabilities affecting Excel, including information disclosure and elevation of privilege. Office Online Server updates end on December 31, 2026.

Does it affect you? Applies to: Organizations running the release version of Office Online Server on x64 computers.

What changes

Fix 1 change

Microsoft Excel

Verified in package

For: Office Online Server administrators

Excel information disclosure and elevation-of-privilege vulnerabilities are resolved.¹

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released: 2026-02-10
Classification: Security Updates
Type: Cumulative update
Restart: Required
Replaces: KB5002824, KB5002817, KB5002801, KB5002797

+12 earlier
KB5002776, KB5002752, KB5002740, KB5002728, KB5002707, KB5002699, KB5002690, KB5002679, KB5002677, KB5002648, KB5002601, KB5002503
Replaced by: KB5002846

Version	Build	Channel
OOS	16.0.10417.20097	General availability

Security

3 vulnerabilities fixed

3 important

Vulnerability	Severity	CVSS
CVE-2026-21259 Microsoft Excel Elevation of Privilege Vulnerability	Important	7.8
CVE-2026-21258 Microsoft Excel Information Disclosure Vulnerability	Important	5.5
CVE-2026-21261 Microsoft Excel Information Disclosure Vulnerability	Important	5.5

Downloads (Microsoft Update Catalog)

Package OOS

1.0 GB

wacserver-x-none.cab Main update · KB5002835 SHA-1: f84ef63a…9cdac7

Updated components

1,597 files changed since the previous update for the same versions.

Top changed components	Files
Office web apps	369
PowerPoint	324
Excel	261
Document conversion	74
Word	50

Verified in package: changed files confirm Microsoft Excel.

Sources

Microsoft Support: KB5002835

Updated Oct 26, 2026

Cited passages from Microsoft's official notes (1)

1. This security update resolves Microsoft Excel information disclosure vulnerability, and Microsoft Excel elevation of privilege vulnerability. support.microsoft.com

Checked automatically: 8 of 8 checks passed, 1 quoted passage · compared with Microsoft's page on Sep 26, 2026

Quotes found in the official pages: passed
Numbers found in the sources: passed
Vulnerabilities from the dossier only: passed
Links to allowed domains only: passed
Every official change covered: passed
Readable plain text: passed
Changes confirmed by the file list: passed
Sources agree: passed

A second AI read the text against the sources: correctness 5/5, clarity 5/5, completeness 4/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake