KB5002835 — Security Update for Office Online Server

Overview

KB5002835 is a critical security update released on February 10, 2026, for Office Online Server. This update addresses multiple high-severity vulnerabilities that could allow remote code execution, information disclosure, and privilege escalation attacks against Office Online Server deployments. The update is essential for maintaining the security posture of environments that rely on Office Online Server for document collaboration and web-based Office functionality.

Affected Systems

This security update applies to the following Office Online Server versions:

The update is compatible with Windows Server 2016, Windows Server 2019, and Windows Server 2022 operating systems where Office Online Server is deployed.

Security Vulnerabilities Addressed

This update resolves five critical security vulnerabilities identified by the Microsoft Security Response Center:

CVE-2026-0847 - Remote Code Execution in Document Processing

A critical vulnerability in the document processing engine that could allow attackers to execute arbitrary code by uploading specially crafted Office documents. This vulnerability has a CVSS score of 9.8 and affects all document types processed by Office Online Server.

CVE-2026-0848 - Authentication Bypass in Web Services

An authentication bypass vulnerability that could allow unauthorized access to Office Online Server resources. Attackers could potentially access and modify documents without proper authentication credentials.

CVE-2026-0849 - Cross-Site Scripting in Document Preview

A cross-site scripting vulnerability in the document preview functionality that could allow malicious scripts to execute in users' browsers, potentially leading to session hijacking and data theft.

CVE-2026-0850 - Privilege Escalation in Service Management

A privilege escalation vulnerability that could allow local users to gain administrative privileges through exploitation of Office Online Server service accounts.

CVE-2026-0851 - Denial of Service in Request Processing

A denial of service vulnerability that could cause Office Online Server to become unresponsive when processing malformed requests, impacting service availability.

Technical Implementation Details

The security update modifies several core components of Office Online Server:

Updated Components

• Microsoft.Office.Web.Common.dll - Enhanced document parsing and validation
• Microsoft.Office.Web.Host.dll - Improved authentication and session management
• Microsoft.Office.Web.UI.dll - Strengthened HTML rendering and sanitization
• Microsoft.Office.Web.Service.dll - Enhanced service account security
• Microsoft.Office.Web.Core.dll - Improved request processing and resource management

Security Enhancements

The update implements several security improvements:

• Enhanced Input Validation: Stricter validation of user inputs and document content to prevent injection attacks
• Improved Authentication: Strengthened token validation and session management mechanisms
• Memory Protection: Enhanced memory protection for document processing operations
• Resource Management: Improved resource allocation and monitoring to prevent denial of service attacks
• Audit Logging: Enhanced logging capabilities for security monitoring and incident response

Deployment Considerations

Organizations should prioritize the deployment of KB5002835 due to the critical nature of the vulnerabilities addressed. The update should be tested in non-production environments before deployment to production systems.

Pre-Deployment Testing

• Verify document upload and preview functionality
• Test authentication mechanisms with existing identity providers
• Validate integration with SharePoint and other Microsoft 365 services
• Confirm proper operation of custom Office Online Server configurations

Deployment Timeline

Microsoft recommends applying this update within 30 days of release for production environments. Critical infrastructure should prioritize immediate deployment after appropriate testing.