KB5002946: Cumulative update for Office Online Server, version OOS, November 2026. Excel code-execution and data disclosure flaws addressed

Excel remote code execution and information disclosure vulnerabilities are addressed. Office Online Server reaches the end of updates on December 31, 2026.

Does it affect you? Applies to: Servers running the release version of Office Online Server. The update package is for x64 systems.

What changes

Fix 1 change

Excel

Verified in package

For: Office Online Server administrators

Excel remote code execution and information disclosure vulnerabilities are addressed.¹

Improvement 1 change

Security update package

For: Office Online Server administrators

The security update package uses build 16.0.10417.20236.²

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released: 2026-11-10
Classification: Security Updates
Type: Cumulative update
Restart: Required
Replaces: KB5002928, KB5002910, KB5002895, KB5002884

+21 earlier
KB5002875, KB5002871, KB5002855, KB5002846, KB5002835, KB5002824, KB5002817, KB5002801, KB5002797, KB5002776, KB5002752, KB5002740, KB5002728, KB5002707, KB5002699, KB5002690, KB5002679, KB5002677, KB5002648, KB5002601, KB5002503

Version	Build	Channel
OOS	16.0.10417.20236	General availability

Security

58 vulnerabilities fixed

11 critical 45 important 2 not rated

Vulnerability	Severity	CVSS
CVE-2026-118292 Microsoft Office Excel Remote Code Execution Vulnerability	Critical	8.8
CVE-2026-118296 Microsoft Office Excel Remote Code Execution Vulnerability	Critical	8.8
CVE-2026-118297 Microsoft Office Excel Remote Code Execution Vulnerability	Critical	8.8
CVE-2026-118701 Microsoft Office Excel Remote Code Execution Vulnerability	Critical	8.8
CVE-2026-118711 Microsoft Office Excel Remote Code Execution Vulnerability	Critical	8.8
CVE-2026-118713 Microsoft Office Excel Remote Code Execution Vulnerability	Critical	8.8
CVE-2026-118730 Microsoft Office Excel Remote Code Execution Vulnerability	Critical	8.8
CVE-2026-120786 Microsoft Office Excel Remote Code Execution Vulnerability	Critical	8.8
CVE-2026-120788 Microsoft Office Excel Remote Code Execution Vulnerability	Critical	8.8
CVE-2026-120789 Microsoft Office Excel Remote Code Execution Vulnerability	Critical	8.8
CVE-2026-124170 Microsoft Office Excel Remote Code Execution Vulnerability	Critical	7.5

The table lists the 11 exploited, publicly disclosed or critical vulnerabilities. See all 58 vulnerabilities →

Downloads (Microsoft Update Catalog)

Package OOS

1.0 GB

wacserver-x-none.cab Main update · KB5002946 SHA-1: 6c4df864…8287d6

Updated components

1,593 files changed since the previous update for the same versions.

Top changed components	Files
Office web apps	369
PowerPoint	322
Excel	260
Document conversion	74
Word	50

Verified in package: changed files confirm Excel.

Page history

Nov 11, 2026

Now also covers build 16.0.10417.20236 (OOS)

Added CVE-2026-120791

Added CVE-2026-124174

Sources

Microsoft Support: KB5002946

Updated Nov 11, 2026

Cited passages from Microsoft's official notes (2)

1. This security update resolves a Microsoft Excel remote code execution vulnerability and a Microsoft Excel information disclosure vulnerability. support.microsoft.com
2. This is build 16.0.10417.20236 of the security update package. support.microsoft.com

Checked automatically: 7 of 8 checks passed, 2 quoted passages · compared with Microsoft's page on Nov 15, 2026

Quotes found in the official pages: passed
Numbers found in the sources: passed
Vulnerabilities from the dossier only: passed
Links to allowed domains only: passed
Every official change covered: passed
Readable plain text: passed
Changes confirmed by the file list: passed
Sources agree: not passed

A second AI read the text against the sources: correctness 5/5, clarity 4/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake