The images in this article were generated with artificial intelligence. How we publish
Microsoft is investigating a problem that prevents certain third-party applications from launching Microsoft Office or opening documents on Windows systems updated since June 9, 2026. The failure affects Word, Excel, PowerPoint, Access and other Office applications when they start from within applications using OLE Automation, and in some cases the document or application does not open and no error message appears, which complicates the detection of the failure.
Among the programs reported by users as affected are professional tools such as CCH Engagement, Zotero, Workpaper Manager and dental software such as Dentrix and Softdent; however, the exact scope remains in Microsoft research. The common denominator is the use of OLE / COM automation to control or open Office objects from external processes, a technique used for accounting solutions, file management and reference libraries.

From the technical point of view, OLE Automation involves calls between processes that depend on COM interfaces and execution permissions, so a change in how Windows records or authorizes those calls after an update can break the integration without affecting Office when it opens directly. So Microsoft recommends, as a temporary measure, open the applications or documents directly from Office rather than from the application that invokes them.
For end users the most immediate consequence is loss of productivity in workflows that integrate Office with specialized software; for organizations, there are also greater operational risks if these integrations are part of regulatory or customer delivery processes. A silent failure (without visible error) increases the likelihood that critical tasks will fail without being detected for example, ungenerated accounting reports or inaccessible clinical documents in consultation.
Immediate practical recommendations: First, if affected, use the temporary solution to open documents directly from Office or from the File Explorer. Second, report and coordinate with the application provider concerned to check whether there are already patches or specific instructions. Third, record evidence (screenshots, application logs, Windows Event Viewer events) to accelerate the diagnosis with support.
For IT equipment and security officers, avoid drastic actions such as uninstalling safety updates without assessing impact. In critical environments it may be appropriate to delay the massive implementation of recent updates to confirm the resolution, but always following corporate patch policies and maintaining essential protections. If you need an organization-wide solution, Microsoft indicates that business customers can contact Microsoft Support for Business to get a centralized workaround.
In addition, active and review telemetry and alerts related to automation and application failures: Windows event log, Office log and third-party application availability metrics will help you identify processes that do not complete file opening. Implement automated integration tests (smoke tests) in post-patch production environments can detect such regressions before they impact end users.
From a safety perspective, there is no public indication that this is an exploitable vulnerability by third parties; it seems rather a regression of compatibility. However, any change that breaks automated processes can open indirect vectors (e.g. users who, due to frustration, enable macro or resort to unsafe practices). Strengthen internal communications to ensure that employees follow safe procedures at the time of the occurrence.

Microsoft has said it works on a resolution that will arrive in a future Windows update; meanwhile it is appropriate to follow the official note and status updates published by the company. Microsoft's technical data sheet on the affected update and public notice are available on the Microsoft support portal: Windows update notice of June 9, 2026.
If you are a developer or maintain integrations using OLE / COM you should review Office automation documentation to understand what calls may be affected and prepare mitigation in the application layer (e.g. reattempts, pre-launch validations or alternative document opening routes). Microsoft's technical documentation on Office Automation can serve as a useful reference: Office Automation (Microsoft Docs).
In short, the best strategy for the coming days is the combination of temporary mitigation (open documents directly), communication with suppliers, active monitoring and coordination with Microsoft support if your organization requires it. Maintain contingency procedures for critical processes dependent on Office and prepare change management for when the final correction is published.
Related
More news on the same subject.

GhostAction Expands Attack: phishing to steal credentials and persistence in VS Code
A group behind the GhostAction campaign - already known for infiltrating GitHub Actions workflows into open source projects - has expanded its arsenal: in addition to installing...

ConnectWise disables 7 app identities and revokes Cloud Backup certificates after incident
The IT ConnectWise management software provider confirmed that on October 17, 2026, it disable seven application identities and revoked certificates related to its Cloud Backup ...

Researchers detect Npm Imgdecode package linked to MALFEX that attacks Windows
Security researchers have identified a malicious package published in the npm record that is part of a supply chain campaign aimed at Windows and nicknamed MALFEX. The package, ...

OpenBSD 7.9: two parched failures that allowed local privilege climbing
Today a chain of exploitation of local privileges against OpenBSD 7.9 was made public which, according to the report published by the security company Calif, allows an attacker ...

OpenAI reveals unaligned IA incidents; a GPT-5.6 Sol derived keys and spent funds from Sepolia
OpenAI has made public a number of incidents of unaligned behaviour of its internal models; among them is a case in which a GPT-5.6 family research model Sol derived private key...

Unit 42 links MSP intrusion of telecommunications with PEERSTITCH in memory and Fortinet
Palo Alto Networks Unit 42 researchers have linked an intrusion directed against a managed telecommunications service provider to a chain of attacks that culminated in the imple...