Security1 publisherNot yet confirmed elsewhere2 min readPublished
Office 2016 and 2019 still get near-monthly Microsoft patches a year after support ended
Microsoft has shipped security updates almost monthly for Office 2016 and 2019 since their end of support, Help Net Security reported. The forecast's author argues the old suites are probably not tested against Microsoft's other updates, so the compatibility risk sits with the teams still running them.
The Watch · Security desk
What happened
- Microsoft's end-of-support notice, issued almost a year ago, said it may issue Office 2016 updates after October 14, 2025, at its sole discretion.
- KB5002907, built to update out-of-date Microsoft 365 apps, drew reports that it removed or deactivated Office 2016 and Office 2019 installs.
- The problem was widespread enough that Microsoft paused KB5002907.
- October's Patch Tuesday also brings the last updates for Windows 11 24H2 Home and Pro editions and the end of ESU support for Exchange Server 2016 and 2019.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- exposure Any machine still running Office 2016 or 2019 can be hit by updates written for other Microsoft products, and KB5002907 showed the result can be a removed or deactivated suite.
- constraint Teams staying on Office 2016 get patches only at Microsoft's sole discretion, so they cannot plan on a security fix arriving in any given month.
- decision Migrating forces a choice between Microsoft 365 and Office 2024 plus an update channel, under channel names Microsoft has changed several times since 2020.
KB5002907 was written to bring out-of-date Microsoft 365 apps current, yet the reported failures were in Office 2016 and Office 2019 [3]. The forecast's author ties that to support status. Because the two suites sit outside mainstream support, "they are probably not tested with the latest updates released for other purposes," the author wrote [16].
The case for an October compatibility problem rests on one incident and one inference [3][16]. The forecast does not date KB5002907, predict an Office 2016 or 2019 failure in the October release, or link either suite to active exploitation. September's release set a record at 973 CVEs [10]. Exploitation was reported for two of them, CVE-2026-85880 and CVE-2026-81963, and the release contained no publicly disclosed vulnerabilities [11]. Two of 973 is about 0.2 percent [15]. For most shops the author's guidance was "business as usual, patch systems at highest risk" [12].
September's updates also broke supported software. Microsoft has said the October release will fix an Excel cut-and-paste failure and a File History/Windows Backup problem, both introduced by the September security updates, according to the forecast [14].
The author drew a conclusion from the KB5002907 episode. "There's clearly an argument to be made that it is time to truly end support for these products and help customers migrate to newer versions," the forecast's author wrote [5].
The forecast also flags the choice of target. Microsoft ships Microsoft 365 and Office 2024 and keeps introducing or renaming update channels [6]. Current Channel was once Monthly Channel, Semi-Annual Enterprise Channel was once Semi-Annual Channel, and Monthly Enterprise Channel was added in May or June 2020 [7]. Starting in July, Microsoft merged the Semi-Annual Enterprise Channel and the Monthly Enterprise Channel into one combined enterprise update channel [8]. "This is the first step in the right direction," the author added [9].
What to watch
- Whether Microsoft resumes KB5002907, and what it changes for machines that still run Office 2016 or 2019.
- Whether the October release carries another discretionary security update for Office 2016 and 2019, or is the first month without one.
- Whether the October fixes for the Excel cut-and-paste and File History/Windows Backup regressions hold or need follow-up patches.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence40
- Adoption
- Insufficient
- Hype gap+10
- Incentives
- Insufficient
- Confidence45
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Microsoft has continued to release security updates almost monthly for both Office 2016 and Office 2019 since their end-of-support date.
- [2]
Microsoft announced end of support for Office 2016 and Office 2019 almost a year ago with the caveat: "at Microsoft's sole discretion, we may choose to issue one or more updates to Office 2016 after October 14, 2025."
- [3]
Microsoft released KB5002907 designed to update out-of-date Microsoft 365 applications; as soon as it was released there were reports of Office 2016 and Office 2019 being removed or deactivated.
- [4]
The KB5002907 problem was so widespread that Microsoft was forced to pause the update.
- [5]
"There's clearly an argument to be made that it is time to truly end support for these products and help customers migrate to newer versions."
- [6]
Microsoft continues to release new major versions of Office, such as Microsoft 365 or Office 2024, and to introduce new update channels or rename existing ones.
- [7]
Current Channel was formerly named Monthly Channel; Semi-Annual Enterprise Channel was formerly named Semi-Annual Channel; Monthly Enterprise Channel was introduced as a new channel in May/June 2020.
- [8]
Starting in July, Microsoft consolidated the Semi-Annual Enterprise Channel and the Monthly Enterprise Channel into a single, combined enterprise update channel.
- [9]
"This is the first step in the right direction."
ReportedSupportedSource: Forecast author, Help Net Security, on the channel consolidationView cited source - [10]
September 2026 Patch Tuesday set an all-time record with 973 CVEs addressed across the Microsoft portfolio.
- [11]
Of September's CVEs, only two, CVE-2026-85880 and CVE-2026-81963, were reported Known Exploited and none were Publicly Disclosed.
- [12]
"business as usual, patch systems at highest risk"
- [13]
October's Patch Tuesday will include the final updates for Windows 11 Version 24H2 Home and Professional editions and the end of ESU support for Exchange Server 2016/2019.
- [14]
Microsoft has reported it will include in October's Patch Tuesday a fix for the Excel cut-and-paste failure that has affected users since the September security updates, and a fix for the File History/Windows Backup issue also created by the September security updates.
- [15]
Known Exploited CVEs were about 0.2 percent of September's 973 CVEs.
- [16]
"they are probably not tested with the latest updates released for other purposes."
ReportedInsufficientSource: Forecast author, Help Net Security, on Office 2016 and 2019 being outside mainstream supportView cited source
Sources
1 independent publisher whose own reporting we read for this story.
- helpnetsecurity.comOctober 2026 Patch Tuesday forecast: Time for an Office cleanup
1 article · October 8, 2026
Topics and entities
Follow any of these and your For You feed starts watching them — no settings page required.
Topics
- Patch TuesdayFollow
- Software end of supportFollow
- Patch And Redeploy LatencyFollow
Entities
- MicrosoftFollow
- Office 2016Follow
- Office 2019Follow
- Microsoft 365Follow
- Office 2024Follow
- KB5002907Follow
- CVE-2026-85880Follow
- CVE-2026-81963Follow
- Help Net SecurityFollow