Microsoft Pauses KB5002907 After Office Activation and Removal Reports

Key points

• Microsoft paused KB5002907 distribution.
• Reports involve Office 2016 and Office 2019 perpetual licenses.
• Some users saw activation fail or software removed.
• No CVE assigned; severity remains medium.
• IT admins should block and audit the update.

Microsoft has halted distribution of KB5002907 while it looks into a set of customer complaints. The update is tied to Office products, and the reports center on perpetual-license copies of Office 2016 and Office 2019. According to those accounts, activation stopped working and, in some cases, installed Office programs were removed from devices. Microsoft 365 is also listed in the product scope, though the clearest reports involve non-subscription Office builds.

For K-12 IT teams, the practical risk is disruption rather than exploitation. Districts that manage computer labs, staff laptops, and administrative workstations may find users locked out of Word, Excel, or other Office tools if the update has already landed. Devices that rely on perpetual licensing are the most likely to need manual recovery, especially if they received the update through Windows Update, Microsoft Update, or a managed deployment channel.

There is no CVE associated with this event, so it is not a vulnerability being exploited in the wild. The severity is best treated as medium: it can interrupt teaching and business operations, but it does not appear to expose data or enable remote compromise. The main concern is availability and the support burden of restoring activation or reinstalling applications across many endpoints.

Microsoft's decision to pause the rollout should limit new exposures. However, machines that already installed KB5002907 may remain in a broken state until the company provides a fix, rollback, or revised package. IT admins should not assume that a paused update means existing problems will resolve automatically.

Watch Microsoft's release health channels, update catalogs, and admin portals for a corrected KB or known-issue rollback. In the meantime, verify which endpoints have the update, confirm Office activation status, and be ready to repair or reinstall affected installations. Clear communication with helpdesk staff and affected users will reduce confusion while Microsoft works on remediation.

What to do now

1. Immediately pause or decline KB5002907 in WSUS, Intune, Configuration Manager, and any update rings.
2. Inventory all endpoints for Office 2016, Office 2019, and Microsoft 365 Apps, then identify devices with KB5002907 installed.
3. For affected machines, run Office repair and reactivate; if applications were removed, reinstall from trusted deployment media.
4. Block the update until Microsoft publishes a revised KB or explicit remediation guidance.
5. Brief the service desk and provide users with a temporary workaround or alternative access to Office web apps.
6. Monitor Microsoft release health, admin center messages, and update catalogs for a fix or rollback.
7. Document affected devices, activation errors, and recovery actions for vendor escalation.

Original source

BleepingComputer