[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fHcydeGYb9luoMkPQ3C4edYLCMco6y7n5HKhzdqTETjs":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":20,"status":21,"created_at":22,"published_at":23,"article":24,"tags":28,"podcasts":41,"controls":48},"2e0f971b-7636-42fd-bca3-7c2e262557ba","faulty-microsoft-update-deactivates-legitimate-office-licenses","4af24d15-ee1b-4031-9194-720ee5255f14","Faulty Microsoft Update Deactivates Legitimate Office Licenses","Microsoft's KB5002907 update incorrectly targeted perpetual Office 2016 and 2019 installations despite being intended only for outdated Microsoft 365 Apps, resulting in widespread license deactivations. The root failure lies in insufficient pre-release testing and inadequate scoping controls that allowed the update to misidentify and affect unintended software versions. Compounding the issue, the update installed automatically on some systems despite being labeled optional, removing user agency and accelerating the blast radius. This incident highlights that even vendor-supplied updates can cause significant operational disruption, and organizations must treat patch deployment as a controlled, validated process rather than a passive event.","**Immediate actions:**\n- Pause or roll back KB5002907 on affected systems and re-enter product keys or sign into a Microsoft account to restore Office licenses.\n- Audit all endpoints for Office installation type (perpetual vs. subscription) to identify which systems are at risk before re-deploying the update.\n\n**Patch management controls:**\n- Enforce a staged patch deployment policy (test → pilot group → broad rollout) with a mandatory validation period before enterprise-wide distribution.\n- Configure Windows Update or WSUS\u002FIntune policies to prevent 'optional' updates from installing automatically without administrator approval.\n- Maintain a current software asset inventory that distinguishes license types so update targeting rules can be applied accurately.\n\n**Long-term improvements:**\n- Implement automated rollback procedures triggered by post-deployment health checks, such as application licensing status or crash telemetry.\n- Subscribe to vendor security and update advisories (e.g., Microsoft Update Catalog, MSRC) to receive early warnings of paused or problematic updates.\n- Establish a documented incident response runbook specifically for faulty update scenarios, including communication templates and recovery steps.",[12,13,14,15,16,17,18,19],"CIS Control 7: Continuous Vulnerability Management","CIS Control 2: Inventory and Control of Software Assets","NIST SP 800-40 Rev. 4: Guide to Enterprise Patch Management Planning","NIST CM-3: Configuration Change Control","NIST SI-2: Flaw Remediation","ITIL Change Management: Change Evaluation and Testing","ISO\u002FIEC 27001: A.12.6.1 Management of Technical Vulnerabilities","NIST IR-4: Incident Handling",{},"published","2026-09-26T20:21:08.628935+00:00","2026-09-26T20:21:08.349+00:00",{"id":7,"url":25,"slug":26,"title":27},"https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fmicrosoft\u002Fmicrosoft-365-kb5002907-update-paused-after-office-license-deactivations\u002F","microsoft-pauses-kb5002907-update-after-office-license-deactivations-b597d5","Microsoft pauses KB5002907 update after Office license deactivations",[29,35],{"id":30,"name":31,"slug":32,"description":33,"color":34},"859cf0ad-a7e9-42bb-a75d-bac6511fa5d5","Configuration Management","configuration-management","Misconfigs, default credentials, exposed services","#eab308",{"id":36,"name":37,"slug":38,"description":39,"color":40},"af7fce9e-1ce8-4156-93bc-09dcfbfdf29d","Patch Management","patch-management","Unpatched vulnerabilities, delayed updates","#ef4444",[42],{"id":43,"date":44,"edition":45,"title":46,"audio_url":47},"13c8d089-3c57-4fc1-a760-c0f278e03864","2026-09-27","morning","ThreatNoir Weekend Brief — September 27","https:\u002F\u002Fcdn.threatnoir.com\u002Fpodcasts\u002F2026-09-27\u002Fthreatnoir-morning-brief-2026-09-27.mp3",[49,52],{"slug":38,"name":50,"problem":51},"Automated patch management","Known holes get closed in days, not months.",{"slug":53,"name":54,"problem":55},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date."]