I was three rows deep into a vendor pricing reconciliation when I noticed the totals were off by twenty-three dollars. Not the kind of off you can chalk up to a rounding error. The kind where the same SKU was showing $4.99 in one sheet and $0.00 in another, after a copy and paste that I had already saved over the source workbook. The bug is real, it is in your Excel right now if you have not updated, and it is the worst kind of regression because nothing in Excel tells you it happened.
Microsoft pushed a security patch on September 8, 2026, labeled KB5002914 in the September notes. The patch fixed a handful of security problems. It also, apparently, broke copy and paste in Excel Online, Excel 2024, Excel 2021, Excel 2019, and Excel 2016, across both Windows and Mac. The official description from Microsoft is that when you copy a value from one cell and paste it into another, “the original source stays selected and the destination is not changed.” The marching ants walk over to the new cell. The cell looks like it took the value. It did not.
The part that is hard to describe without sounding paranoid is what it feels like to use Excel in this state. You select a cell. You hit Ctrl+C. You click the destination. You hit Ctrl+V. The cell you clicked now has the marching ants around it, and you tab to the next cell and keep working. You have no way to know, from anything Excel shows you, that the paste silently dropped your data. There is no error dialog. There is no beep. There is no red highlight, no warning in the status bar, no cell comment. The cell looks like any other empty cell. If you did not compare it to the value you thought you pasted, you would not notice.
For a one-time paste, this is a curiosity. For a hundred pastes across an afternoon of ledger work, this is a way to corrupt a workbook in a way you cannot later audit. You cannot look at a finished workbook and say “this cell was supposed to be 47.99 and is 0.00 because the patch broke paste,” because the cell shows no breadcrumb that it was ever the target of a paste at all. The audit trail, if you have one, only tells you the value, not the absence.
What Microsoft is calling the fix, and why it is not really one
Microsoft did ship a follow-up patch. It is called KB5002665. If you read the headline you might think the story is over. It is not. KB5002665 only repairs the bug for the MSI (Microsoft Installer, the older line-of-business installer that IT departments push to fleets) version of Excel 2016. If you installed Office through the regular installer from a Microsoft account, or you downloaded it from the Mac App Store, or you run any flavour of Microsoft 365 Home, Business, or Apps for enterprise, you are using a different installer called Click-to-Run. KB5002665 does not cover Click-to-Run. Microsoft is explicit about that. So the fix in the headline covers roughly a sliver of the installed base, and that sliver happens to be the segment most likely to have someone managing their updates in the first place.
Excel 2019, 2021, and 2024 users get a different, quieter path. The September 12 cumulative updates Microsoft pushed for those versions appear, based on user reports, to clear the regression. Microsoft has not officially documented those cumulative updates as the paste-bug fix, which is the part that should make a careful admin pause. If you call Microsoft support and ask “which patch fixed the paste regression in Excel 2021,” they will not point you at a support note. They will, at best, tell you to install the latest cumulative and see. That is fine for a managed device that takes updates automatically. It is awkward for a regulated environment where you have to justify every patch with a KB number from the vendor.
The plain read: if you are on Office 2019, 2021, 2024, or Microsoft 365, you should make sure you have the September 12 cumulative update or later. If you are on the MSI edition of Office 2016, you need KB5002665 specifically. If you are on the Click-to-Run edition of Office 2016, neither of those patches covers you, and you are on the workaround until Microsoft decides to ship another update.
The workaround, and why I prefer it to the alternative
Microsoft’s official workaround is Paste Special. The keyboard shortcut is Ctrl+Alt+V, which opens a dialog. The dialog has several paste targets, and five of them bypass the broken code path. The safe targets are Formulas, Formulas and number formats, Values, Values and number formats, and Paste Link. Each one of these writes something visibly different into the destination cell, which means you can actually see whether the paste worked.
- Formulas. Pastes only the formula, not the formatting or the value. Use this if you are moving a calculation across sheets.
- Formulas and number formats. Same, plus the number display style. Useful when the cell is currency or percent.
- Values. Pastes the resolved value of a cell. Use this if you copied a calculated result and want to lock in the number.
- Values and number formats. Same, with display style preserved. This is the closest substitute for a normal paste when you are copying a finished number.
- Paste Link. Creates a live reference. Use this if you want the destination to track the source going forward.
The key thing is that you will see something land in the destination cell. The cell will not look empty. If the destination stays empty after you hit OK, that is a problem you can investigate in the moment, not a problem you discover next week when the totals do not reconcile.
For day-to-day work, switching to Paste Special for every paste is annoying. The reason to do it anyway is that the alternative is the nuclear option, which is uninstalling KB5002914. That does work, immediately. It also reopens the security holes the patch was shipped to close, which include remote code execution (a vulnerability where an attacker can run code on your machine remotely) and information disclosure bugs. Pulling a security patch to recover a productivity feature is a tradeoff I would only make on a machine that has no internet exposure and no untrusted documents coming in. If you are reading this on a regular work laptop, do not uninstall the patch. Just use Paste Special.
A short verification checklist for your own desk
Before you trust any paste you do today, run three checks. Open a fresh Excel workbook. Type a number into A1. Copy it. Click B1. Hit Ctrl+V. If B1 shows the number, your machine is fine. If B1 stays empty while A1 still has the marching ants around it, you are running the broken build, and every paste you do until you fix it is suspect. Once you have confirmed the bug is live on your machine, switch your paste habit to Ctrl+Alt+V with the Values or Formulas target for the rest of the day. That will save your work and your reputation. After that, install the September 12 cumulative update or KB5002665, whichever applies to your install channel, and verify the same test passes. If it does, return to normal paste. If it does not, keep using Paste Special and keep an eye on the Office release notes for the next patch.
Trade-offs
The honest costs of the safe path are real. Paste Special is slower than normal paste, because every paste becomes a dialog and a click. Across a day of ledger work, that adds up to a non-trivial amount of friction. The faster your paste loop, the more this hurts. You also have to think about which of the five targets you want, which is a small cognitive tax that normal paste never charged you.
Uninstalling KB5002914 is faster but only if you can accept the security gap. For an air-gapped machine on a locked-down network, this is a reasonable choice and is probably what a careful admin would do anyway. For anything that touches email or the open internet, the safer choice is to keep the patch on and absorb the Paste Special friction until Microsoft ships a confirmed repair for your install channel.
There is also a tradeoff nobody is talking about, which is the cost of not knowing. The patch was live for weeks before this got wide attention, and the failure mode is silent. If you do any volume of paste-driven work, you should assume at least some of your recent workbooks may have empty cells where you thought you had data. The fastest way to find out is to spot-check the workbooks you have been touching since mid-September. That is a separate exercise, but it is the one that protects you from the bigger failure mode, which is finding out from your auditor six months from now.
What I would tell past me
Three things, in order.
- Never trust a paste that does not visibly change the destination cell. Marching ants are not evidence. The destination cell is the evidence. If it does not change, the paste did not happen.
- Check the install channel before you trust a Microsoft headline. MSI and Click-to-Run are different products for patching purposes. A fix that covers one may say nothing about the other. Always verify which one you are on before you assume a KB applies.
- Keep the security patch on, even when the fix is annoying. The workarounds are ugly but contained. Removing the patch is clean but reopens a hole. The math almost always favors living with the workaround.