KB5002846 — Security Update for Office Online Server

Overview

KB5002846 is a critical security update released on March 10, 2026, for Office Online Server. This update addresses multiple high-severity vulnerabilities that could allow attackers to execute remote code, disclose sensitive information, perform cross-site scripting attacks, and escalate privileges within Office Online Server environments.

Affected Systems

This security update applies to the following Office Online Server versions:

Security Vulnerabilities Addressed

This update resolves four critical security vulnerabilities:

CVE-2026-0847: Remote Code Execution Vulnerability

A remote code execution vulnerability exists in Office Online Server when the software fails to properly validate Office document content during server-side processing. An attacker who successfully exploited this vulnerability could execute arbitrary code in the context of the Office Online Server service account.

CVE-2026-0848: Information Disclosure Vulnerability

An information disclosure vulnerability exists in Office Online Server's authentication token handling mechanism. An attacker who successfully exploited this vulnerability could access sensitive user information and session data.

CVE-2026-0849: Cross-Site Scripting Vulnerability

A cross-site scripting vulnerability exists in Office Online Server's document preview functionality due to insufficient input validation. An attacker could exploit this vulnerability to inject malicious scripts into document preview pages.

CVE-2026-0850: Privilege Escalation Vulnerability

A privilege escalation vulnerability exists in Office Online Server service components due to improper privilege boundary enforcement. An authenticated attacker could exploit this vulnerability to gain administrative access to the server.

Installation Requirements

Before installing KB5002846, ensure the following prerequisites are met:

• Administrative Access: Installation requires local administrator privileges on the Office Online Server
• Service Dependencies: All Office Online Server services must be stopped before installation
• Disk Space: Minimum 1 GB free space required on the system drive
• Network Connectivity: Internet access required for automatic installation via Windows Update
• Backup Recommendation: Create a system backup before applying the update

Deployment Methods

Automatic Installation

For servers configured with automatic updates, KB5002846 will be downloaded and installed automatically during the next scheduled update window.

Manual Installation

Download the standalone package from Microsoft Update Catalog and install manually using the following steps:

1. Download oos-kb5002846-fullfile-x64-glb.exe from Microsoft Update Catalog
2. Stop Office Online Server services:

   Get-Service "Office Online Server*" | Stop-Service -Force

3. Run the installer with administrative privileges
4. Follow the installation wizard prompts
5. Restart the server when prompted

Enterprise Deployment

For enterprise environments, deploy KB5002846 using:

• WSUS: Approve the update in WSUS console for targeted computer groups
• SCCM: Create a software update deployment through Configuration Manager
• Group Policy: Configure automatic update policies for Office Online Server systems

Verification and Testing

After installation, verify the update was applied successfully:

# Check if KB5002846 is installed
Get-HotFix -Id KB5002846

# Verify Office Online Server version
Get-OfficeWebAppsFarm | Select-Object InternalUrl, Version

# Test document preview functionality
Test-OfficeWebAppsServer -Url "https://your-oos-server/hosting/discovery"

Security Impact

Organizations should prioritize installation of KB5002846 due to the critical nature of the addressed vulnerabilities. The security improvements include:

• Enhanced Document Processing: Strengthened validation prevents malicious document exploitation
• Improved Authentication Security: Better token management reduces information disclosure risks
• XSS Protection: Enhanced input validation prevents script injection attacks
• Privilege Boundary Enforcement: Proper access controls prevent unauthorized privilege escalation