- Microsoft paused its optional update KB5002907 after some Office 2016 and Office 2019 devices were left without a functioning Office. It has not said why.
- Help Net Security argues that suites outside mainstream support are probably not tested against newer updates. That is the author's theory, not a Microsoft finding.
- Count your Office 2016 and 2019 devices, and send every update, optional ones included, through a pilot group before wide rollout.
A repair update that left some devices without Office
Microsoft built KB5002907 to help Microsoft 365 installs that had stopped updating. Then people running Office 2016 or Office 2019 began reporting that their devices misbehaved after installing it. On some machines, no usable Office installation remained at all.
Microsoft has paused the rollout. It has not said how many devices were hit. It has also not explained why an update aimed at Microsoft 365 Apps affected Office 2016 and 2019 devices.
One reading comes from Help Net Security. Its author argues that older suites outside mainstream support are probably not tested against newer updates. If that is right, a support date tells leaders less than they assume. Microsoft has not confirmed it.
What KB5002907 was built to do
The update is optional. It shows up among the extra items in Windows Update, separate from the operating system's own patches. Nobody receives it unless they choose to install it.
Its target was Windows PCs running Microsoft 365 Apps that had gone more than 90 days without updating. Only two update tracks, known as channels, were eligible: Current Channel and Monthly Enterprise Channel. A channel decides how quickly a device receives new builds.
On a qualifying PC, the update starts the usual Microsoft 365 Apps update routine and tries to bring the install to a current build. It leaves the assigned channel alone. Where Group Policy or Cloud Update controls updates, Microsoft says the update changes nothing.
Microsoft lists two outcomes for affected devices. Some products may show as unlicensed, which calls for reactivation. Others may have been uninstalled entirely, which Microsoft calls rare, and those need a reinstall.
One theory: older suites miss the testing
Help Net Security points out that Microsoft set an end-of-support date for Office 2016 and Office 2019 roughly a year ago. Microsoft kept the option to ship further updates after October 14, 2025. The outlet says it has done so almost every month.
The outlet's author then offers a theory. Because the older suites sit outside mainstream support, newer updates written for other purposes are probably not checked against them. That is a theory, not Microsoft's finding.
Help Net Security also reports that Office 2016 and 2019 were removed or deactivated as soon as KB5002907 appeared. It says the problem was widespread enough to force the pause. Microsoft's own page refers only to "some devices".
If the theory holds, the episode illustrates two things that can come apart. One is a vendor's promise to keep patching. The other is how well each patch is tested on old installs. Microsoft has not said which applies here.
What is known is narrower. A support date and a patch's behaviour on old installs are different questions. Microsoft has answered the first and not yet the second.
Routine patch volume still needs a pilot
Help Net Security reports that September 2026 Patch Tuesday addressed 973 CVEs, which it calls a record. It counts only two as known exploited: CVE-2026-85880 and CVE-2026-81963. Its advice is that most organisations can treat this as business as usual and patch the highest-risk systems first.
KB5002907 is a separate optional update and was not part of that release. Still, the two stories point the same way. Fast patching and safe patching are different goals. A small pilot group costs little next to a fleet of PCs that cannot open Word. This is the publication's view, not Microsoft's.
Questions to put to your IT team
First, how many devices run Office 2016 or Office 2019, and who owns the plan to retire them? Second, does each device get updates through Group Policy, Cloud Update or neither? Microsoft says KB5002907 changes nothing on managed devices.
Third, has anyone installed KB5002907 already? Look for devices that now show as unlicensed or have no Office at all. Fourth, do you hold licence details and install media so you can reactivate or reinstall quickly?
Fifth, do optional updates go through a pilot group first? Sixth, which channel names does your fleet use? Help Net Security reports that since July, Microsoft has merged the Semi-Annual Enterprise Channel and Monthly Enterprise Channel into one enterprise channel. Check that your records match.
A support date says when a vendor stops promising. It says little about whether the next update was tested on your oldest installs.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: Microsoft.
