Skip to the content
The Update Bureau
Office Online Server OOS Office Online Server Security update
Patch Tuesday

KB5002875

KB5002875: Cumulative update for Office Online Server, version OOS, June 2026. Excel remote code execution and information disclosure flaws addressed

In short

Addresses seven Important vulnerabilities, including Excel flaws that could allow remote code execution or information disclosure. Office Online Server updates end on December 31, 2026.

Does it affect you? Applies to: Organizations running the release version of Office Online Server.

Build
16.0.10417.20137
Security
7 fixed
Restart
Required

What changes

Fixes 2 changes

Microsoft Excel

2 items

For: Office Online Server users

  • An Excel vulnerability that could allow remote code execution is addressed.1
    Resolves a Microsoft Excel remote code execution vulnerability.
  • An Excel vulnerability that could expose information is addressed.1
    Resolves a Microsoft Excel information disclosure vulnerability.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2026-06-09
Classification
Security Updates
Type
Cumulative update
Restart
Required
Replaces
KB5002871, KB5002855, KB5002846, KB5002835
+16 earlier KB5002824, KB5002817, KB5002801, KB5002797, KB5002776, KB5002752, KB5002740, KB5002728, KB5002707, KB5002699, KB5002690, KB5002679, KB5002677, KB5002648, KB5002601, KB5002503
Replaced by
KB5002884
VersionBuildChannel
OOS 16.0.10417.20137 General availability

Security

7 vulnerabilities fixed
7 important
VulnerabilitySeverityCVSS
CVE-2026-44822
Microsoft Excel Information Disclosure Vulnerability
 Important 8.2
CVE-2026-44817
Microsoft Excel Remote Code Execution Vulnerability
 Important 7.8
CVE-2026-44820
Microsoft Excel Remote Code Execution Vulnerability
 Important 7.8
CVE-2026-44823
Microsoft Excel Remote Code Execution Vulnerability
 Important 7.8
CVE-2026-45469
Microsoft Excel Remote Code Execution Vulnerability
 Important 7.8
CVE-2026-44818
Microsoft Excel Remote Code Execution Vulnerability
 Important 7.0
CVE-2026-45455
Microsoft Excel Information Disclosure Vulnerability
 Important 3.3

Downloads (Microsoft Update Catalog)

Package OOS
1.0 GB
wacserver-x-none.cab Main update · KB5002875 SHA-1: 2b7deed5…d46516

Sources

Updated
Cited passages from Microsoft's official notes (1)
  1. 1. This security update resolves Microsoft Excel remote code execution vulnerability and Microsoft Excel Information Disclosure vulnerability. support.microsoft.com
Checked automatically: 8 of 8 checks passed, 1 quoted passage · compared with Microsoft's page on Sep 26, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: passed

A second AI read the text against the sources: correctness 5/5, clarity 4/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake