Should you update to Microsoft 365 Apps 2606 build 20131.20154?
No: install Microsoft 365 Apps 2609 build 20430.20182 instead. Microsoft 365 Apps 2606 build 20131.20154 is a security update Microsoft released on 14 Jul 2026 for Windows. It fixes 78 security flaws, 16 rated critical and 62 important by Microsoft.[1] None of them is known to be used in attacks.
It has since been replaced by Microsoft 365 Apps 2607 build 20228.20190, released 11 Aug 2026, which includes all of its fixes. If you’re on an older version, install that instead.
Should you update?
No: install Microsoft 365 Apps 2609 build 20430.20182 instead. Microsoft 365 Apps 2609 build 20430.20182 came out on 13 Oct 2026 and includes every fix in Microsoft 365 Apps 2606 build 20131.20154, so there’s no reason to stop at this one. Software Update offers the newest version your device can run.
Is Microsoft 365 Apps 2606 build 20131.20154 still safe?
Not any more. The 3 updates since, up to Microsoft 365 Apps 2609 build 20430.20182, fix 321 security flaws that Microsoft 365 Apps 2606 build 20131.20154 doesn’t, and each became public the day its fix shipped. Installing it is safe: get it only from Office’s own Update Now (File → Account → Update Options), never from a link in an email, text or pop-up.
What it fixes
Microsoft lists 78 security flaws, 16 rated critical and 62 important by Microsoft.[1] The 78 critical and important ones are:
| Flaw | Severity | What Microsoft calls it |
|---|---|---|
CVE-2026-50301 | Critical | Microsoft Office Remote Code Execution Vulnerability |
CVE-2026-50314 | Critical | Microsoft Office Remote Code Execution Vulnerability |
CVE-2026-50467 | Critical | Microsoft Office Remote Code Execution Vulnerability |
CVE-2026-55018 | Critical | Microsoft Office Remote Code Execution Vulnerability |
CVE-2026-55022 | Critical | Microsoft Office Remote Code Execution Vulnerability |
CVE-2026-55033 | Critical | Microsoft Word Remote Code Execution Vulnerability |
CVE-2026-55043 | Critical | Microsoft PowerPoint Remote Code Execution Vulnerability |
CVE-2026-55045 | Critical | Microsoft Office Remote Code Execution Vulnerability |
CVE-2026-55049 | Critical | Microsoft Office Remote Code Execution Vulnerability |
CVE-2026-55056 | Critical | Microsoft Office Remote Code Execution Vulnerability |
CVE-2026-55120 | Critical | Microsoft PowerPoint Remote Code Execution Vulnerability |
CVE-2026-55123 | Critical | Microsoft PowerPoint Remote Code Execution Vulnerability |
CVE-2026-55127 | Critical | Microsoft Word Remote Code Execution Vulnerability |
CVE-2026-55129 | Critical | Microsoft Office Remote Code Execution Vulnerability |
CVE-2026-55132 | Critical | Microsoft Word Remote Code Execution Vulnerability |
CVE-2026-55140 | Critical | Microsoft Office Remote Code Execution Vulnerability |
CVE-2026-47290 | Important | Microsoft Office Remote Code Execution Vulnerability |
CVE-2026-47642 | Important | Microsoft Excel Remote Code Execution Vulnerability |
CVE-2026-48580 | Important | Microsoft Excel Information Disclosure Vulnerability |
CVE-2026-50387 | Important | Windows GDI Elevation of Privilege Vulnerability |
CVE-2026-50408 | Important | Microsoft Excel Information Disclosure Vulnerability |
CVE-2026-50665 | Important | Microsoft Office Information Disclosure Vulnerability |
CVE-2026-50675 | Important | Microsoft Excel Remote Code Execution Vulnerability |
CVE-2026-50678 | Important | Microsoft Excel Information Disclosure Vulnerability |
CVE-2026-54131 | Important | Microsoft Excel Remote Code Execution Vulnerability |
CVE-2026-54988 | Important | Microsoft Excel Information Disclosure Vulnerability |
CVE-2026-55017 | Important | Microsoft Office Remote Code Execution Vulnerability |
CVE-2026-55023 | Important | Microsoft Office Information Disclosure Vulnerability |
CVE-2026-55024 | Important | Microsoft Excel Remote Code Execution Vulnerability |
CVE-2026-55025 | Important | Microsoft Excel Remote Code Execution Vulnerability |
| and 48 more | ||
How to update, and how long it takes
Five to fifteen minutes. Your Office apps close while it installs.
- Open Word (or Excel or PowerPoint) and click File, then Account.In Outlook it’s File → Office Account.
- Click Update Options, then Update Now.Office downloads the update in the background. Close your Office apps when it asks; they reopen when it’s done.
To check it worked: File → Account in Word or Excel: under About it shows e.g. Version 2609 (Build 20430.20182 Click-to-Run). It should say 2607 build 20228.20190 or later.
2605 build 20026.20168 vs 2606 build 20131.20154
Microsoft 365 Apps 2605 build 20026.20168, released 9 Jun 2026, fixed 29 security flaws. Microsoft 365 Apps 2606 build 20131.20154 fixes 78 security flaws and includes the fixes before it, so going straight to 2606 build 20131.20154 gets you both.
- Before: Microsoft 365 Apps 2605 build 20026.20168, 9 Jun 2026, 29 security flaws
- After: Microsoft 365 Apps 2607 build 20228.20190, 11 Aug 2026, 89 security flaws
- Microsoft 365 Apps updates, every release and the latest version
- Updates, the latest version of everything HARD tracks
References
- ^ Microsoft. “Release notes for Microsoft Office security updates, July 14, 2026”, 14 Jul 2026.