Should you update to Microsoft 365 Apps 2607 build 20228.20190?
No: install Microsoft 365 Apps 2609 build 20430.20182 instead. Microsoft 365 Apps 2607 build 20228.20190 is a security update Microsoft released on 11 Aug 2026 for Windows. It fixes 89 security flaws, 19 rated critical and 69 important by Microsoft.[1] None of them is known to be used in attacks.
It has since been replaced by Microsoft 365 Apps 2608 build 20326.20144, released 8 Sep 2026, which includes all of its fixes. If you’re on an older version, install that instead.
Should you update?
No: install Microsoft 365 Apps 2609 build 20430.20182 instead. Microsoft 365 Apps 2609 build 20430.20182 came out on 13 Oct 2026 and includes every fix in Microsoft 365 Apps 2607 build 20228.20190, so there’s no reason to stop at this one. Software Update offers the newest version your device can run.
Is Microsoft 365 Apps 2607 build 20228.20190 still safe?
Not any more. The 2 updates since, up to Microsoft 365 Apps 2609 build 20430.20182, fix 232 security flaws that Microsoft 365 Apps 2607 build 20228.20190 doesn’t, and each became public the day its fix shipped. Installing it is safe: get it only from Office’s own Update Now (File → Account → Update Options), never from a link in an email, text or pop-up.
What it fixes
Microsoft lists 89 security flaws, 19 rated critical and 69 important by Microsoft.[1] The 88 critical and important ones are:
| Flaw | Severity | What Microsoft calls it |
|---|---|---|
CVE-2026-63513 | Critical | Microsoft Office Graphics Component Remote Code Execution Vulnerability |
CVE-2026-63515 | Critical | Microsoft Office Remote Code Execution Vulnerability |
CVE-2026-63518 | Critical | Microsoft Office Word Remote Code Execution Vulnerability |
CVE-2026-63519 | Critical | Microsoft Office Graphics Component Remote Code Execution Vulnerability |
CVE-2026-63525 | Critical | Microsoft Office Word Remote Code Execution Vulnerability |
CVE-2026-63526 | Critical | Microsoft Office Graphics Component Remote Code Execution Vulnerability |
CVE-2026-63532 | Critical | Microsoft Office Remote Code Execution Vulnerability |
CVE-2026-64898 | Critical | Microsoft Office Remote Code Execution Vulnerability |
CVE-2026-64903 | Critical | Microsoft Office Remote Code Execution Vulnerability |
CVE-2026-64907 | Critical | Microsoft Office Word Remote Code Execution Vulnerability |
CVE-2026-64909 | Critical | Microsoft Office Remote Code Execution Vulnerability |
CVE-2026-64910 | Critical | Microsoft Office Remote Code Execution Vulnerability |
CVE-2026-64911 | Critical | Microsoft Office Remote Code Execution Vulnerability |
CVE-2026-65657 | Critical | Microsoft Office Remote Code Execution Vulnerability |
CVE-2026-65664 | Critical | Microsoft Office Graphics Component Remote Code Execution Vulnerability |
CVE-2026-66807 | Critical | Microsoft Office Graphics Component Remote Code Execution Vulnerability |
CVE-2026-68794 | Critical | Microsoft Excel Remote Code Execution Vulnerability |
CVE-2026-68804 | Critical | Microsoft Excel Remote Code Execution Vulnerability |
CVE-2026-68816 | Critical | Microsoft Excel Remote Code Execution Vulnerability |
CVE-2026-58651 | Important | Microsoft Word Remote Code Execution Vulnerability |
CVE-2026-62842 | Important | Microsoft Office Graphics Component Information Disclosure Vulnerability |
CVE-2026-62882 | Important | Microsoft Outlook Spoofing Vulnerability |
CVE-2026-63517 | Important | Microsoft Office Graphics Component Information Disclosure Vulnerability |
CVE-2026-63521 | Important | Microsoft Office Word Information Disclosure Vulnerability |
CVE-2026-63524 | Important | Microsoft Office Information Disclosure Vulnerability |
CVE-2026-63527 | Important | Microsoft Office Word Remote Code Execution Vulnerability |
CVE-2026-63528 | Important | Microsoft Office Word Information Disclosure Vulnerability |
CVE-2026-63529 | Important | Microsoft Office Information Disclosure Vulnerability |
CVE-2026-63530 | Important | Microsoft Office Word Information Disclosure Vulnerability |
CVE-2026-63531 | Important | Microsoft Office Word Information Disclosure Vulnerability |
| and 58 more | ||
How to update, and how long it takes
Five to fifteen minutes. Your Office apps close while it installs.
- Open Word (or Excel or PowerPoint) and click File, then Account.In Outlook it’s File → Office Account.
- Click Update Options, then Update Now.Office downloads the update in the background. Close your Office apps when it asks; they reopen when it’s done.
To check it worked: File → Account in Word or Excel: under About it shows e.g. Version 2609 (Build 20430.20182 Click-to-Run). It should say 2608 build 20326.20144 or later.
2606 build 20131.20154 vs 2607 build 20228.20190
Microsoft 365 Apps 2606 build 20131.20154, released 14 Jul 2026, fixed 78 security flaws. Microsoft 365 Apps 2607 build 20228.20190 fixes 89 security flaws and includes the fixes before it, so going straight to 2607 build 20228.20190 gets you both.
- Before: Microsoft 365 Apps 2606 build 20131.20154, 14 Jul 2026, 78 security flaws
- After: Microsoft 365 Apps 2608 build 20326.20144, 8 Sep 2026, 100 security flaws
- Microsoft 365 Apps updates, every release and the latest version
- Updates, the latest version of everything HARD tracks
References
- ^ Microsoft. “Release notes for Microsoft Office security updates, August 11, 2026”, 11 Aug 2026.