Skip to main content

Microsoft pauses KB5002907 update after Office license deactivations

0
Medium
News
Published: 09/26/2026 (09/26/2026, 15:50:38 UTC)
Source: Bleeping Computer

Description

Microsoft paused the rollout of the KB5002907 update for Microsoft 365 after reports that it deactivated or removed perpetual Office 2016 and Office 2019 installations. The update, intended for out-of-date Microsoft 365 Apps, was optional but reportedly installed automatically on some devices. Affected users found their Office products showing as unlicensed or completely uninstalled. Reactivating with the original product key or reinstalling Office resolved the issue. Microsoft acknowledged the problem, confirmed the update's pause, and is investigating the cause.

AI-Powered Analysis

Machine-generated threat intelligence

AILast updated: 09/26/2026, 16:02:53 UTC

Technical Analysis

KB5002907 is an optional Microsoft 365 update targeting installations more than 90 days out of date. Despite being optional, it reportedly installed automatically on some systems, affecting perpetual Office 2016 and Office 2019 licenses by causing deactivation or removal of the Office suite. Issues include Office showing as an unlicensed product and, in rare cases, complete removal of Office installations. Reactivation or reinstallation is required to restore functionality. Microsoft paused the update rollout and is investigating the issue, noting possible complications with mixed 32-bit and 64-bit Office components, though this is unconfirmed.

Potential Impact

The update caused legitimate perpetual Office 2016 and Office 2019 licenses to become deactivated or, in rare cases, led to complete removal of Office installations. This disruption affects user productivity by requiring manual reactivation or reinstallation of Office. No evidence of security compromise or exploitation is reported.

Defensive Guidance

Microsoft has paused the rollout of KB5002907 and is investigating the issue. Users affected by license deactivation should attempt to reactivate their Office products using their original product keys or by signing into their Microsoft accounts to select the license. In cases where Office was removed, users should reinstall their purchased Office 2016 or Office 2019 copies. No further action is recommended until Microsoft provides updated guidance.

Pro Console: star threats, build custom feeds, automate alerts via Slack, email & webhooks.Upgrade to Pro

Technical Details

Classification
{"confidence":0.3,"severitySource":"default","classifier":"rss-v2"}
Article Source
{"url":"https://www.bleepingcomputer.com/news/microsoft/microsoft-365-kb5002907-update-paused-after-office-license-deactivations/","fetched":true,"fetchedAt":"2026-09-26T16:02:48.944Z","wordCount":1020}

Threat ID: 6ab7eca8f7a7c54106756765

Added to database: 09/26/2026, 16:02:48 UTC

Last enriched: 09/26/2026, 16:02:53 UTC

Last updated: 09/27/2026, 00:53:46 UTC

Views: 13

Community Reviews

0 reviews

Crowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.

Sort by
Loading community insights…

Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.

Actions

PRO

Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.

Please log in to the Console to use AI analysis features.

Need more coverage?

Upgrade to Pro Console for AI refresh and higher limits.

For incident response and remediation, OffSeq services can help resolve threats faster.

Latest Threats

Breach by OffSeqOFFSEQFRIENDS — 25% OFF

Check if your credentials are on the dark web

Instant breach scanning across billions of leaked records. Free tier available.

Scan now
OffSeq TrainingCredly Certified

Lead Pen Test Professional

Technical5-day eLearningPECB Accredited
View courses