Microsoft released KB5002865 on May 12, 2026, patching three security vulnerabilities in Microsoft Excel 2016. The update addresses two remote code execution flaws (CVE-2026-40362 and CVE-2026-40359) and one information disclosure vulnerability (CVE-2026-40360). Per Microsoft's official support documentation, all three affect the MSI-based edition of Office 2016. The update replaces KB5002860.
Both RCE vulnerabilities are use-after-free conditions (CWE-416) in Excel's workbook parsing engine. An attacker can achieve arbitrary code execution by delivering a crafted Excel file. No privileges are required beyond convincing the user to open the file.
Key takeaways
- Fixes CVE-2026-40362, CVE-2026-40359 (RCE), and CVE-2026-40360 (info disclosure).
- All CVSS 7.8, require user interaction.
- MSI-based Office 2016 only, not Click-to-Run.
- Superseded by KB5002877 (June 2026).
- CVE-2026-40362 flagged Exploitation More Likely.
Affected
What KB5002865 Fixes
KB5002865 is a May 2026 Patch Tuesday security update for Microsoft Excel 2016. Per Microsoft's official KB article, the update resolves two types of vulnerabilities: remote code execution and information disclosure.
CVE-2026-40362 and CVE-2026-40359 are both use-after-free (CWE-416) vulnerabilities in Excel's workbook parsing engine. Per SentinelOne's analysis, CVE-2026-40359 involves a dangling pointer condition where freed memory is accessed during document processing, allowing arbitrary code execution in the user's security context.
CVE-2026-40360 is an out-of-bounds read that allows information disclosure. All three carry CVSS 7.8 and require user interaction.
Affected Systems
KB5002865 applies exclusively to MSI-based Office 2016 installations. Click-to-Run editions receive patches through the Office Update channel separately. Covers both 32-bit and 64-bit editions on Windows 7 SP1 through Windows 11.
The same CVEs also affect Office Online Server, patched through KB5002871. A system restart is required.
Patching and Mitigation
Organizations should install KB5002877 (June successor), which supersedes KB5002865. Enable Protected View for internet and email files, deploy ASR rules blocking Office child process creation, and block legacy .xls formats at the email gateway.
Verify installation with Get-HotFix -Id KB5002865 in PowerShell.
Timeline
Impact & actions
Three vulnerabilities allow RCE and info disclosure via crafted spreadsheets.
Security: CVSS 7.8 for all three CVEs.
Recommended actions · High urgency
- 1Install KB5002877 on all MSI-based Excel 2016 installations.
- 2Enable Protected View for internet and email files.
- 3Deploy ASR rules blocking Office child process creation.
Response
Vendor
Customer guidance
Install KB5002877. Enable Protected View and ASR rules.
FAQ
What CVEs does KB5002865 fix?
CVE-2026-40362 and CVE-2026-40359 (RCE, use-after-free) and CVE-2026-40360 (out-of-bounds read). All CVSS 7.8.
Does it apply to Click-to-Run Office?
No. Only MSI-based Office 2016. Click-to-Run gets patches through the Office Update channel.
Is KB5002865 still the latest patch?
No. KB5002877 (June 9, 2026) supersedes it.
Are these being actively exploited?
No active exploitation reported, but Microsoft flagged CVE-2026-40362 as Exploitation More Likely.
The bottom line
KB5002865 patches three CVSS 7.8 vulnerabilities in Excel 2016. Superseded by KB5002877.
What happens next
What to do
