Skip to the content
The Update Bureau

Office Online Server

Office Online Server updates

All published releases for Office Online Server, newest first: what each update changes, whether to install it and any confirmed known issues. Latest release: November 10, 2026.

Latest build per version

Office Online Server updates

  • Office Online Server OOS Office Online Server Security update
    Updated

    KB5002946

    Excel code-execution and data disclosure flaws addressed

    Excel remote code execution and information disclosure vulnerabilities are addressed. Office Online Server reaches the end of updates on December 31, 2026.

    Office Online Server reaches the end of updates on December 31, 2026.

    Key changes 58 CVEs · 2 changes

    • Improved Security update package: The security update package uses build 16.0.10417.20236.
    • Fix Excel: Excel remote code execution and information disclosure vulnerabilities are addressed.
    • Critical CVE-2026-118292: Microsoft Office Excel Remote Code Execution Vulnerability

    Read update Source: Microsoft

    Build
    16.0.10417.20236
    Security
    58 fixed · 11 critical
    Restart
    Required
  • Office Online Server OOS Office Online Server Security update
    Updated

    KB5002928

    Excel remote code execution vulnerabilities addressed before support ends

    Addresses 44 vulnerabilities, including 13 critical Excel remote code execution vulnerabilities. Updates for all Office Online Server editions end December 31, 2026.

    Check the newer update, KB5002946
    Updates for all Office Online Server editions end December 31, 2026.

    Key changes 44 CVEs · 1 change

    • Fix Microsoft Excel: The update addresses Excel remote code execution and information disclosure vulnerabilities.
    • Critical CVE-2026-105718: Microsoft Excel Remote Code Execution Vulnerability
    • Critical CVE-2026-97739: Microsoft Office Excel Remote Code Execution Vulnerability

    Read update Source: Microsoft

    Build
    16.0.10417.20228
    Security
    44 fixed · 13 critical
    Restart
    Required
  • Office Online Server OOS Office Online Server Security update

    KB5002910

    Excel remote code execution and disclosure flaws addressed

    The update addresses 28 vulnerabilities in Office Online Server, including Excel remote code execution and information disclosure flaws. Office Online Server updates end on December 31, 2026.

    Check the newer update, KB5002928
    Updates for Office Online Server end on December 31, 2026.

    Key changes 28 CVEs · 1 change

    • Fix Excel: Security fixes address Excel remote code execution and information disclosure vulnerabilities.
    • CVSS 7.8 CVE-2026-81947: Microsoft Excel Remote Code Execution Vulnerability
    • CVSS 7.8 CVE-2026-81956: Microsoft Excel Remote Code Execution Vulnerability

    Read update Source: Microsoft

    Build
    16.0.10417.20207
    Security
    28 vulnerabilities fixed
    Restart
    Required
  • Office Online Server OOS Office Online Server Security update
    Updated

    KB5002884

    Excel remote code execution and information disclosure flaws fixed

    Excel vulnerabilities that could allow remote code execution or expose information are fixed. Office Online Server updates end on December 31, 2026.

    Check the newer update, KB5002895
    Office Online Server updates end on December 31, 2026.

    Key changes 58 CVEs · 2 changes

    • Fix Microsoft Excel: The update fixes Excel flaws that could let attackers run code remotely.
    • Fix Microsoft Excel: The update fixes Excel flaws that could expose information.
    • Critical CVE-2026-68794: Microsoft Excel Remote Code Execution Vulnerability

    Read update Source: Microsoft

    Build
    16.0.10417.20175
    Security
    58 fixed · 3 critical
    Restart
    Required
  • Office Online Server OOS Office Online Server Security update

    KB5002875

    Excel remote code execution and information disclosure flaws addressed

    Addresses seven Important vulnerabilities, including Excel flaws that could allow remote code execution or information disclosure. Office Online Server updates end on December 31, 2026.

    Check the newer update, KB5002884
    Office Online Server updates end on December 31, 2026.

    Key changes 7 CVEs · 2 changes

    • Fix Microsoft Excel: An Excel vulnerability that could allow remote code execution is addressed.
    • Fix Microsoft Excel: An Excel vulnerability that could expose information is addressed.
    • CVSS 8.2 CVE-2026-44822: Microsoft Excel Information Disclosure Vulnerability

    Read update Source: Microsoft

    Build
    16.0.10417.20137
    Security
    7 vulnerabilities fixed
    Restart
    Required
  • Office Online Server OOS Office Online Server Security update

    KB5002871

    Excel code execution and information disclosure flaws fixed

    Resolves three Important Excel vulnerabilities, including remote code execution and information disclosure flaws.

    Check the newer update, KB5002875
    Support for all Office Online Server editions ends on December 31, 2026.

    Key changes 3 CVEs · 1 change

    • Fix Microsoft Excel: Excel remote code execution and information disclosure vulnerabilities are resolved.
    • CVSS 7.8 CVE-2026-40359: Microsoft Excel Remote Code Execution Vulnerability
    • CVSS 7.8 CVE-2026-40360: Microsoft Excel Information Disclosure Vulnerability

    Read update Source: Microsoft

    Build
    16.0.10417.20128
    Security
    3 vulnerabilities fixed
    Restart
    Required
  • Office Online Server OOS Office Online Server Security update

    KB5002855

    Excel flaws that could run code or expose information fixed

    The update fixes five Important vulnerabilities, including Excel flaws that could let attackers run code or expose information. Office Online Server updates end for all editions on December 31, 2026.

    Check the newer update, KB5002871
    Updates for all Office Online Server editions end on December 31, 2026.

    Key changes 5 CVEs · 2 changes

    • Fix Excel: A flaw in Excel could let an attacker run code on the server.
    • Fix Excel: A flaw in Excel could expose information.
    • CVSS 7.8 CVE-2026-32189: Microsoft Excel Remote Code Execution Vulnerability

    Read update Source: Microsoft

    Build
    16.0.10417.20113
    Security
    5 vulnerabilities fixed
    Restart
    Required
  • Office Online Server OOS Office Online Server Security update

    KB5002846

    Excel remote code execution vulnerability resolved

    Resolves a Microsoft Excel remote code execution vulnerability in Office Online Server.

    Check the newer update, KB5002855
    Office Online Server updates end on December 31, 2026.

    Key changes 4 CVEs · 1 change

    • Fix Excel: The Microsoft Excel remote code execution vulnerability addressed by this update is resolved.
    • CVSS 8.4 CVE-2026-26109: Microsoft Excel Remote Code Execution Vulnerability
    • CVSS 7.8 CVE-2026-26107: Microsoft Excel Remote Code Execution Vulnerability

    Read update Source: Microsoft

    Build
    16.0.10417.20102
    Security
    4 vulnerabilities fixed
    Restart
    Required
  • Office Online Server OOS Office Online Server Security update

    KB5002835

    Excel data disclosure and privilege vulnerabilities addressed

    The update resolves three Important vulnerabilities affecting Excel, including information disclosure and elevation of privilege. Office Online Server updates end on December 31, 2026.

    Check the newer update, KB5002846
    Office Online Server updates end on December 31, 2026.

    Key changes 3 CVEs · 1 change

    • Fix Microsoft Excel: Excel information disclosure and elevation-of-privilege vulnerabilities are resolved.
    • CVSS 7.8 CVE-2026-21259: Microsoft Excel Elevation of Privilege Vulnerability
    • CVSS 5.5 CVE-2026-21258: Microsoft Excel Information Disclosure Vulnerability

    Read update Source: Microsoft

    Build
    16.0.10417.20097
    Security
    3 vulnerabilities fixed
    Restart
    Required
  • Office Online Server OOS Office Online Server Security update

    KB5002824

    Two critical Excel remote-code-execution flaws addressed

    The update addresses two critical Excel remote-code-execution vulnerabilities and one other vulnerability. Office Online Server updates for all editions end on December 31, 2026.

    Check the newer update, KB5002835
    Updates for all Office Online Server editions end on December 31, 2026.

    Key changes 3 CVEs · 1 change

    • Fix Excel: A Microsoft Excel remote-code-execution vulnerability is addressed.
    • Critical CVE-2026-20955: Microsoft Excel Remote Code Execution Vulnerability
    • Critical CVE-2026-20957: Microsoft Excel Remote Code Execution Vulnerability

    Read update Source: Microsoft

    Build
    16.0.10417.20083
    Security
    3 fixed · 2 critical
    Restart
    Required
  • Office Online Server OOS Office Online Server Security update

    KB5002817

    Excel remote code execution flaws resolved

    The update resolves five Important-severity Microsoft Excel remote code execution vulnerabilities.

    Check the newer update, KB5002824

    Key changes 5 CVEs · 1 change

    • Fix Microsoft Excel: Microsoft Excel remote code execution vulnerabilities are resolved.
    • CVSS 7.8 CVE-2025-62556: Microsoft Excel Remote Code Execution Vulnerability
    • CVSS 7.8 CVE-2025-62560: Microsoft Excel Remote Code Execution Vulnerability

    Read update Source: Microsoft

    Build
    16.0.10417.20075
    Security
    5 vulnerabilities fixed
    Restart
    Required
  • Office Online Server OOS Office Online Server Security update

    KB5002801

    Excel information disclosure and code execution flaws addressed

    Six Important-severity vulnerabilities are addressed, including Excel information disclosure and remote code execution vulnerabilities.

    Check the newer update, KB5002817

    Key changes 6 CVEs · 1 change

    • Fix Excel: Excel information disclosure and remote code execution vulnerabilities are addressed.
    • CVSS 7.8 CVE-2025-60727: Microsoft Excel Remote Code Execution Vulnerability
    • CVSS 7.8 CVE-2025-62200: Microsoft Excel Remote Code Execution Vulnerability

    Read update Source: Microsoft

    Build
    16.0.10417.20068
    Security
    6 vulnerabilities fixed
    Restart
    Required
  • Office Online Server OOS Office Online Server Security update

    KB5002797

    Excel code-execution and information-disclosure flaws addressed

    The update addresses Excel vulnerabilities, including a Critical remote code execution flaw. It fixes 8 vulnerabilities in total.

    Check the newer update, KB5002801

    Key changes 8 CVEs · 1 change

    • Fix Microsoft Excel: Excel information disclosure and remote code execution vulnerabilities are addressed.
    • Critical CVE-2025-59236: Microsoft Excel Remote Code Execution Vulnerability
    • CVSS 7.8 CVE-2025-59223: Microsoft Excel Remote Code Execution Vulnerability

    Read update Source: Microsoft

    Build
    16.0.10417.20059
    Security
    8 fixed · 1 critical
    Restart
    Required
  • Office Online Server OOS Office Online Server Security update

    KB5002776

    Excel remote code execution vulnerability resolved

    The update resolves an Excel remote code execution vulnerability and fixes six Important vulnerabilities in total. Office Online Server updates end on December 31, 2026.

    Check the newer update, KB5002797
    Updates for all Office Online Server editions end on December 31, 2026.

    Key changes 6 CVEs · 1 change

    • Fix Excel: The update resolves a Microsoft Excel remote code execution vulnerability.
    • CVSS 7.8 CVE-2025-54896: Microsoft Excel Remote Code Execution Vulnerability
    • CVSS 7.8 CVE-2025-54898: Microsoft Excel Remote Code Execution Vulnerability

    Read update Source: Microsoft

    Build
    16.0.10417.20047
    Security
    6 vulnerabilities fixed
    Restart
    Required
  • Office Online Server OOS Office Online Server Security update

    KB5002752

    Excel remote code execution vulnerability resolved

    Resolves a Microsoft Excel remote code execution vulnerability in Office Online Server.

    Check the newer update, KB5002776

    Key changes 5 CVEs · 1 change

    • Fix Excel: The Excel remote code execution vulnerability addressed by this update is resolved.
    • CVSS 7.8 CVE-2025-53735: Microsoft Excel Remote Code Execution Vulnerability
    • CVSS 7.8 CVE-2025-53737: Microsoft Excel Remote Code Execution Vulnerability

    Read update Source: Microsoft

    Build
    16.0.10417.20034
    Security
    5 vulnerabilities fixed
    Restart
    Required
  • Office Online Server OOS Office Online Server Security update

    KB5002740

    Closes Excel and Office code-execution flaws

    The update resolves three vulnerabilities, including a Critical Microsoft Office remote code execution flaw and vulnerabilities in Excel.

    Check the newer update, KB5002752

    Key changes 3 CVEs · 3 changes

    • Fix Excel: An Excel remote code execution vulnerability is resolved.
    • Fix Excel: An Excel information disclosure vulnerability is resolved.
    • Fix Office: A Microsoft Office remote code execution vulnerability is resolved.

    Read update Source: Microsoft

    Build
    16.0.10417.20027
    Security
    3 fixed · 1 critical
    Restart
    Required
  • Office Online Server OOS Office Online Server Security update

    KB5002728

    Excel remote code execution vulnerability resolved

    Resolves an Important remote code execution vulnerability in Excel, CVE-2025-47165.

    Check the newer update, KB5002740

    Key changes 1 CVE · 1 change

    • Fix Excel: A remote code execution vulnerability in Excel is resolved.
    • CVSS 7.8 CVE-2025-47165: Microsoft Excel Remote Code Execution Vulnerability

    Read update Source: Microsoft

    Build
    16.0.10417.20018
    Security
    1 vulnerability fixed
    Restart
    Required
  • Office Online Server OOS Office Online Server Security update

    KB5002707

    Excel remote code execution flaw resolved

    Resolves a Microsoft Excel remote code execution vulnerability. It addresses seven vulnerabilities, all rated Important.

    Check the newer update, KB5002728

    Key changes 7 CVEs · 2 changes

    • Improved Security update: This update replaces the previously released security update KB5002699.
    • Fix Excel: A Microsoft Excel remote code execution vulnerability is resolved.
    • CVSS 7.8 CVE-2025-29977: Microsoft Excel Remote Code Execution Vulnerability

    Read update Source: Microsoft

    Build
    16.0.10417.20010
    Security
    7 vulnerabilities fixed
    Restart
    Required
  • Office Online Server OOS Office Online Server Security update

    KB5002699

    Excel and Office remote code execution flaws patched

    Resolves remote code execution vulnerabilities in Excel and Office, reducing the risk of an attacker running code through them.

    Check the newer update, KB5002707

    Key changes 3 CVEs · 1 change

    • Fix Excel and Office: Remote code execution vulnerabilities in Excel and Office are resolved.
    • CVSS 7.8 CVE-2025-26642: Microsoft Office Remote Code Execution Vulnerability
    • CVSS 7.8 CVE-2025-27746: Microsoft Office Remote Code Execution Vulnerability

    Read update Source: Microsoft

    Build
    16.0.10417.20003
    Security
    3 vulnerabilities fixed
    Restart
    Required
  • Office Online Server OOS Office Online Server Security update

    KB5002690

    Excel flaw that could let attackers run code remotely is fixed

    Fixes three Important-severity vulnerabilities. It addresses an Excel flaw that could let an attacker run code remotely.

    Check the newer update, KB5002699

    Key changes 3 CVEs · 1 change

    • Fix Microsoft Excel: An Excel flaw that could let an attacker run code remotely is addressed.
    • CVSS 7.8 CVE-2025-24075: Microsoft Excel Remote Code Execution Vulnerability
    • CVSS 7.8 CVE-2025-24081: Microsoft Excel Remote Code Execution Vulnerability

    Read update Source: Microsoft

    Build
    16.0.10416.20073
    Security
    3 vulnerabilities fixed
    Restart
    Required
  • Office Online Server OOS Office Online Server Security update

    KB5002679

    Excel remote code execution vulnerability resolved

    Resolves a Microsoft Excel remote code execution vulnerability in Office Online Server. It addresses five vulnerabilities, including one rated Critical.

    Check the newer update, KB5002690

    Key changes 5 CVEs · 1 change

    • Fix Excel: The Microsoft Excel remote code execution vulnerability is resolved.
    • Critical CVE-2025-21381: Microsoft Excel Remote Code Execution Vulnerability
    • CVSS 7.8 CVE-2025-21386: Microsoft Excel Remote Code Execution Vulnerability

    Read update Source: Microsoft

    Build
    16.0.10416.20058
    Security
    5 fixed · 1 critical
    Restart
    Required
  • Office Online Server OOS Office Online Server Security update

    KB5002677

    Excel remote-code execution vulnerabilities addressed

    Addresses two critical Excel remote-code execution vulnerabilities, CVE-2025-21354 and CVE-2025-21362. It applies to the release version of Office Online Server.

    Check the newer update, KB5002679

    Key changes 2 CVEs · 1 change

    • Fix Microsoft Excel: The update resolves a remote code execution vulnerability in Excel.
    • Critical CVE-2025-21354: Microsoft Excel Remote Code Execution Vulnerability
    • Critical CVE-2025-21362: Microsoft Excel Remote Code Execution Vulnerability

    Read update Source: Microsoft

    Build
    16.0.10416.20047
    Security
    2 fixed · 2 critical
    Restart
    Required
  • Office Online Server OOS Office Online Server Security update

    KB5002648

    Excel remote code execution vulnerability resolved

    Resolves a Microsoft Excel remote code execution vulnerability, CVE-2024-49026, rated Important.

    Check the newer update, KB5002677

    Key changes 1 CVE · 1 change

    • Fix Microsoft Excel: The Microsoft Excel remote code execution vulnerability is resolved.
    • CVSS 7.8 CVE-2024-49026: Microsoft Excel Remote Code Execution Vulnerability

    Read update Source: Microsoft

    Build
    16.0.10416.20007
    Security
    1 vulnerability fixed
    Restart
    Required
  • Office Online Server OOS Office Online Server Security update

    KB5002601

    Microsoft Excel elevation-of-privilege flaw resolved

    Resolves a Microsoft Excel vulnerability that could allow elevation of privilege. It applies to the release version of Office Online Server.

    Check the newer update, KB5002648

    Key changes 1 CVE · 1 change

    • Fix Microsoft Excel: A Microsoft Excel vulnerability that could allow elevation of privilege is resolved.
    • CVSS 7.8 CVE-2024-43465: Microsoft Excel Elevation of Privilege Vulnerability

    Read update Source: Microsoft

    Build
    16.0.10414.20000
    Security
    1 vulnerability fixed
    Restart
    Required