Microsoft confirmed that a regression introduced in the September 2026 security update KB5002914 creates an Excel 2016 copy paste bug that disables the standard copy-and-paste workflow for a subset of users. The problem first appeared on Microsoft Q&A and Reddit, where affected users reported that the source cells remain highlighted while the destination stays unchanged and no error message is shown. In response, Microsoft released a corrective update, KB5002655, that restores the missing functionality—but only for the MSI-based edition of Office 2016. The fix does not extend to Click-to-Run versions such as Office 365 Home, leaving many enterprise and consumer users without a permanent solution.

Scope of the Excel 2016 copy paste bug

The regression impacts Excel 2016, 2019, 2021 and the online version, yet the current mitigation targets only the 2016 MSI build. Users of newer desktop releases (Excel 2024) and the web-based suite continue to experience the issue without a dedicated patch. The root cause is a code regression in the copy-paste handling routine introduced by KB5002914, which Microsoft described as an unintended side-effect of the security hardening work performed in that update.

Operational impact on business users

Finance teams, data analysts, and any workflow that relies on rapid cell duplication see a hidden productivity drain. Because the failure is silent, users may assume their data transferred correctly, leading to downstream errors in reports or models. In regulated environments, unnoticed data loss could trigger compliance concerns, especially where audit trails depend on accurate spreadsheet manipulation.

The bug also interferes with conditional formatting rules. Microsoft’s guidance notes that certain scenarios involving conditional formatting may still encounter failures even after applying KB5002655. Organizations that heavily leverage conditional formatting for risk scoring or KPI dashboards should test the fix in a controlled environment before broad deployment.

Mitigation strategies

Paste Special workaround

Microsoft recommends using the Paste Special dialog (Ctrl+Alt+V) as a temporary bypass. This method forces Excel to execute a paste operation via an explicit command, avoiding the silent failure path. Users can select Values, Formulas, Formats, or a combination directly from the dialog. While this adds a few keystrokes, it restores functional parity until a universal fix is released.

Uninstalling the problematic update

Rolling back KB5002914 restores copy-paste but also removes a suite of security patches that address remote-code-execution and information-disclosure vulnerabilities disclosed earlier in 2026. The rollback command for Office 2016 is:

"C:\Program Files\Common Files\Microsoft Shared\OFFICE16\Oarpmany.exe" /removereleaseinpatch "{90160000-0012-0000-1000-0000000FF1CE}" "{27882596-A8ED-4382-9C71-6CD2DD19F732}" "1033" "0"

Security teams must weigh the immediate productivity gain against the elevated threat surface created by removing those protections.

Deploying the targeted fix

Enterprises that manage Office installations via centralized deployment tools can push KB5002655 to affected MSI-based 2016 clients. The update is available through Windows Update and the Microsoft Update Catalog. Administrators should verify the installer type before deployment; Click-to-Run installations will not benefit and may require a separate remediation path.

Broader product and market implications

The incident underscores the tension between rapid security patching and regression testing in large, complex codebases. Microsoft’s September 2026 patch cycle introduced multiple critical fixes, yet the Excel 2016 copy paste bug slipped through quality assurance. For the broader software-as-a-service market, the episode may accelerate demand for more granular update controls, where organizations can opt out of non-critical changes that could disrupt core workflows.

From a market-cap perspective, the episode had negligible effect on Microsoft’s valuation, but it serves as a reminder that even mature products can generate operational risk. Investors tracking the market cap rankings of technology firms may note that such incidents, while minor in financial terms, can influence enterprise purchasing decisions, especially for organizations that prioritize stability over feature velocity.

Regulatory and compliance lens

Financial regulators in the EU and US have issued guidance on spreadsheet risk management, emphasizing the need for auditability and change control. A silent copy-paste failure could be construed as a control weakness if it leads to undocumented data manipulation. Companies subject to Sarbanes-Oxley (SOX) or the EU’s MiFID II should document the mitigation steps taken—whether applying the targeted fix, using Paste Special, or rolling back the update—and retain evidence of testing.

What to watch next

Microsoft has indicated that a permanent, universal fix is in development for all affected Excel versions. The timeline is unclear, but the company typically aligns such releases with its monthly Patch Tuesday cadence. Stakeholders should monitor the Microsoft Security Response Center (MSRC) blog for announcements and verify rollout status via the Office Update History page.

In parallel, the broader Office ecosystem may see increased scrutiny of the Click-to-Run update pipeline. If the regression is isolated to the MSI installer, Microsoft may need to align the two pathways to prevent divergent bug surfaces.

For organizations that rely on automated spreadsheet processing—such as crypto-trading bots that ingest Excel-generated price feeds—the bug highlights the importance of validating data integrity after each update. Implementing checksum verification or cross-checking against a secondary data source can mitigate the risk of silent copy-paste failures corrupting downstream processes.

The same week Microsoft released the Excel fix, it also addressed a separate issue that blocked Windows 365 users from downloading Office and another that prevented third-party applications from launching Office apps on up-to-date Windows systems. These concurrent fixes illustrate the breadth of the platform’s update challenges and reinforce the need for comprehensive testing across all product layers.

Actionable takeaways

  • Verify whether your Office 2016 installation is MSI-based before applying KB5002655.
  • Deploy the Paste Special shortcut as a stop-gap for all affected users.
  • If you choose to uninstall KB5002914, immediately re-apply any missing security patches through the Microsoft Update Catalog.
  • Document mitigation steps to satisfy audit requirements under SOX or MiFID II.
  • Monitor Microsoft’s security advisory channels for the universal Excel fix.

Source: Microsoft fixes broken copy and paste for Excel 2016 users

Explore more on this topic