CyberNew CyberNew
Threat Intelligence & APT BleepingComputer 1 month ago

Microsoft confirms KB5002914 Excel update breaks copy and paste

CN
CyberNew Threat Research Desk
• Original Reporting: BleepingComputer
CyberNew Threat Intel Assessment
Assessed Severity: INFORMATIONAL
Impacted Surface
Enterprise Perimeter & Network Defense
Intelligence Sector
Threat Intelligence & APT

Analyst Takeaway

"Microsoft has confirmed that copy and paste may silently fail for some Excel users after installing the September 2026 KB5002914 security update. This follows a wave of customer reports on Reddit and the Microsoft Q&A forums that the KB5002914 Office security update is breaking copy-and-paste , autofill, and formula dragging in Excel. The company has confirmed these issues, saying they affect..."

Recommended Defense & Mitigation

  • Threat Monitoring: Ingest published IOCs into SIEM/EDR detection rules for continuous telemetry monitoring.
  • Security Awareness: Alert staff and maintain baseline endpoint hardening across endpoints.
Curated & Verified by CyberNew Threat Intelligence Desk Standard Defense Framework (NIST / MITRE ATT&CK)

Excel

Microsoft has confirmed that copy and paste may silently fail for some Excel users after installing the September 2026 KB5002914 security update.

This follows a wave of customer reports on Reddit and the Microsoft Q&A forums that the KB5002914 Office security update is breaking copy-and-paste, autofill, and formula dragging in Excel.

The company has confirmed these issues, saying they affect Microsoft Excel 2024, 2021, 2019, and 2016.

"Although users try to paste content, the source remains selected and the destination is unmodified," Microsoft said in an updated support document.

"When this issue occurs, users receive no indication of the failure, such as a beep or error message. Microsoft is researching the issue and will post more information in this article when the information becomes available."

While Microsoft is still working to resolve this bug, affected Excel users have reported that uninstalling KB5002914 restores copy-and-paste functionality on impacted systems.

Office 2016:
"C:\Program Files\Common Files\Microsoft Shared\OFFICE16\Oarpmany.exe" /removereleaseinpatch "{90160000-0012-0000-1000-0000000FF1CE}" "{27882596-A8ED-4382-9C71-6CD2DD19F732}" "1033" "0"

Office 2019:
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe" /update user updatetoversion=16.0.10417.20197

Office 2021 & 2024:
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe" /update user updatetoversion=16.0.20326.20132
Save your seat

Source Verification & Original Intelligence

This threat report was reviewed by CyberNew analysts and cross-referenced with primary security disclosures from BleepingComputer.

Primary Advisory →