CyberNew CyberNew
Threat Intelligence & APT BleepingComputer 2 weeks ago

Microsoft pauses KB5002907 update after Office license deactivations

CN
CyberNew Threat Research Desk
• Original Reporting: BleepingComputer
CyberNew Threat Intel Assessment
Assessed Severity: INFORMATIONAL
Impacted Surface
Enterprise Perimeter & Network Defense
Intelligence Sector
Threat Intelligence & APT

Analyst Takeaway

"Microsoft has paused the rollout of the KB5002907 Microsoft 365 update after users report that it deactivated, or in some cases completely removed, perpetual Office 2016 and Office 2019 installations. KB5002907, titled "Optional update for out-of-date Microsoft 365 Apps installations," was released to help users update Microsoft 365 Apps installations that are more than 90 days out of date. "This..."

Recommended Defense & Mitigation

  • Threat Monitoring: Ingest published IOCs into SIEM/EDR detection rules for continuous telemetry monitoring.
  • Security Awareness: Alert staff and maintain baseline endpoint hardening across endpoints.
Curated & Verified by CyberNew Threat Intelligence Desk Standard Defense Framework (NIST / MITRE ATT&CK)

Microsoft 365

Microsoft has paused the rollout of the KB5002907 Microsoft 365 update after users report that it deactivated, or in some cases completely removed, perpetual Office 2016 and Office 2019 installations.

KB5002907, titled "Optional update for out-of-date Microsoft 365 Apps installations," was released to help users update Microsoft 365 Apps installations that are more than 90 days out of date.

"This optional update is available only for Windows PCs with Microsoft 365 Apps installations that are more than 90 days out of date and use Current Channel or Monthly Enterprise Channel," explains the KB5002907 release notes.

"Installing the update can help the apps resume updating and move to a current build for the device's assigned update channel."

Microsoft says KB5002907 is an optional update offered through Windows Update and does not install automatically.

Shortly after the update was released, BleepingComputer was told by Christian Van Hautte, who runs an MSP in Belgium, that several of his customers suddenly found their perpetual Office installations showing as an "Unlicensed Product."

Save your seat

Source Verification & Original Intelligence

This threat report was reviewed by CyberNew analysts and cross-referenced with primary security disclosures from BleepingComputer.

Primary Advisory →