September Excel security update breaks copy-paste for some users

Users began reporting the issue soon after Microsoft released the KB5002914 security patch on September 9, 2026, with complaints appearing on Reddit and the Microsoft Q&A forums. Reports indicate the bug is not limited to a single Office release or installation method: one user reported it on Office LTSC Standard 2021, while another said it affects both MSI and Click-to-Run installations.

"It seems that security update kb5002914 might have bricked autofill and copy paste in Excel 2016," wrote one Reddit user. Others confirmed similar problems, with one saying copy and paste and formula dragging "no longer work" and that their entire team was blocked after installing the update.

Affected users report that uninstalling KB5002914 restores Excel's copy-and-paste functionality. A PowerShell command for removing the update from MSI-based installations was shared on the Microsoft Q&A forum, with one user reporting it resolved the issue. For Click-to-Run installations, downgrading the Office build using XML or Group Policy is also reported to work.

A workaround involving replacing the updated excel.exe executable with an older version has been shared, but BleepingComputer does not recommend this approach, as it could leave the installation with mismatched files and potentially cause stability, compatibility, or security problems.

BleepingComputer tested Excel 2019 Version 2508 and was unable to reproduce the problem. The publication has contacted Microsoft for comment and will update the story if a response is received.

Why This Matters

Copy-paste and formula dragging are fundamental Excel operations; a bug that disables them can halt productivity for individuals and teams.
The issue affects a broad range of Office versions and installation methods, meaning many users could be impacted.
The conflict between needed security updates and functional regressions highlights a recurring tension in software patching.

Background

Microsoft releases security updates on the second Tuesday of each month, known as Patch Tuesday. The September 2026 patch included fixes for 966 flaws and two zero-days. While security patches are critical, they sometimes introduce regressions in functionality—this Excel bug is one such example. Users typically have limited options: apply the security fix and risk workflow disruptions, or delay patching and remain exposed to vulnerabilities.

Key Perspectives

Affected users: They rely on Excel for daily tasks and are blocked by broken copy-paste and autofill. Many need a quick fix and are sharing workarounds, though some solutions (like replacing executables) carry risks. IT administrators: They must balance security compliance with operational continuity. Rolling back a security update may be necessary to restore productivity, but it leaves systems unpatched against the vulnerabilities the update addressed. Microsoft: The company has not yet publicly acknowledged the issue or provided an official workaround. A response and fix are expected, but timing remains unclear.

What to Watch

Microsoft's official acknowledgment and whether a corrective patch is issued quickly.
Whether the bug is reproduced more widely and if additional workarounds emerge.
User discussions in forums for signs of wider impact or new workarounds.

ZOTPAPER