KB5002910: Cumulative update for Office Online Server, version OOS, September 2026. Excel remote code execution and disclosure flaws addressed

The update addresses 28 vulnerabilities in Office Online Server, including Excel remote code execution and information disclosure flaws. Office Online Server updates end on December 31, 2026.

Does it affect you? Applies to: Computers running the release version of Office Online Server. The update package is for x64.

What changes

Fix 1 change

Excel

Verified in package

For: Office Online Server administrators

Security fixes address Excel remote code execution and information disclosure vulnerabilities.¹
Resolves Microsoft Excel remote code execution and information disclosure vulnerabilities.

Known issues

Resolved Affects: Organizations and IT administrators Resolved by KB4461632

In Excel Online, the paste operation might fail silently.

The previously listed silent paste failure in Excel Online is resolved by KB4461632.²

Resolution Fixed in KB4461632

Install KB4461632 (or a later cumulative update) on affected devices. No manual workaround is required after updating.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released: 2026-09-08
Classification: Security Updates
Type: Cumulative update
Restart: Required
Replaces: KB5002895, KB5002884, KB5002875, KB5002871

+19 earlier
KB5002855, KB5002846, KB5002835, KB5002824, KB5002817, KB5002801, KB5002797, KB5002776, KB5002752, KB5002740, KB5002728, KB5002707, KB5002699, KB5002690, KB5002679, KB5002677, KB5002648, KB5002601, KB5002503
Replaced by: KB5002928

Version	Build	Channel
OOS	16.0.10417.20207	General availability

Security

28 vulnerabilities fixed

5 important 23 not rated

Vulnerability	Severity	CVSS
CVE-2026-81396 Microsoft Excel Remote Code Execution Vulnerability	Important	7.8
CVE-2026-81947 Microsoft Excel Remote Code Execution Vulnerability	Important	7.8
CVE-2026-81956 Microsoft Excel Remote Code Execution Vulnerability	Important	7.8
CVE-2026-81390 Microsoft Excel Information Disclosure Vulnerability	Important	5.5
CVE-2026-81401 Microsoft Excel Information Disclosure Vulnerability	Important	5.5
CVE-2026-78518 Microsoft Office Excel Remote Code Execution Vulnerability	Not rated	—
CVE-2026-81386 Microsoft Excel Remote Code Execution Vulnerability	Not rated	—
CVE-2026-81387 Microsoft Excel Information Disclosure Vulnerability	Not rated	—
CVE-2026-81388 Microsoft Excel Remote Code Execution Vulnerability	Not rated	—
CVE-2026-81389 Microsoft Excel Remote Code Execution Vulnerability	Not rated	—
CVE-2026-81392 Microsoft Excel Information Disclosure Vulnerability	Not rated	—
CVE-2026-81393 Microsoft Excel Information Disclosure Vulnerability	Not rated	—
CVE-2026-81394 Microsoft Excel Information Disclosure Vulnerability	Not rated	—
CVE-2026-81395 Microsoft Excel Information Disclosure Vulnerability	Not rated	—
CVE-2026-81397 Microsoft Excel Remote Code Execution Vulnerability	Not rated	—
CVE-2026-81398 Microsoft Excel Remote Code Execution Vulnerability	Not rated	—
CVE-2026-81399 Microsoft Excel Information Disclosure Vulnerability	Not rated	—
CVE-2026-81400 Microsoft Excel Information Disclosure Vulnerability	Not rated	—
CVE-2026-81948 Microsoft Excel Remote Code Execution Vulnerability	Not rated	—
CVE-2026-81949 Microsoft Excel Remote Code Execution Vulnerability	Not rated	—
CVE-2026-81950 Microsoft Excel Remote Code Execution Vulnerability	Not rated	—
CVE-2026-81951 Microsoft Excel Remote Code Execution Vulnerability	Not rated	—
CVE-2026-81953 Microsoft Excel Remote Code Execution Vulnerability	Not rated	—
CVE-2026-81954 Microsoft Excel Remote Code Execution Vulnerability	Not rated	—
CVE-2026-81957 Microsoft Excel Remote Code Execution Vulnerability	Not rated	—
CVE-2026-81959 Microsoft Excel Remote Code Execution Vulnerability	Not rated	—
CVE-2026-81960 Microsoft Excel Remote Code Execution Vulnerability	Not rated	—
CVE-2026-85875 Microsoft Office Excel Information Disclosure Vulnerability	Not rated	—

Downloads (Microsoft Update Catalog)

Package OOS

1.0 GB

wacserver-x-none.cab Main update · KB5002910 SHA-1: 3ecb5dd9…7a8eef

Updated components

1,618 files changed since the previous update for the same versions.

Top changed components	Files
Office web apps	369
PowerPoint	324
Excel	261
Document conversion	74
Word	50

Verified in package: changed files confirm Excel.

Sources

Microsoft Support: KB5002910

Updated Oct 26, 2026

Cited passages from Microsoft's official notes (2)

1. This security update resolves Microsoft Excel remote code execution vulnerability and Microsoft Excel Information Disclosure vulnerability. support.microsoft.com
2. This issue is fixed in the September 22, 2026, update for Office Online Server (KB4461632). support.microsoft.com

Checked automatically: 7 of 8 checks passed, 2 quoted passages · compared with Microsoft's page on Nov 14, 2026

Quotes found in the official pages: passed
Numbers found in the sources: passed
Vulnerabilities from the dossier only: passed
Links to allowed domains only: passed
Every official change covered: passed
Readable plain text: passed
Changes confirmed by the file list: passed
Sources agree: not passed

A second AI read the text against the sources: correctness 5/5, clarity 3/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake