Security Updates for Microsoft Office Products C2R: How to Fix It

Security Updates for Microsoft Office Products C2R is a monthly Nessus finding meaning a Click-to-Run Office install (Microsoft 365 Apps, Office 2019, 2021 or 2024) is older than the build carrying that month’s security fixes. Fix it by forcing a Click-to-Run update, clearing any policy that blocks or pins updates, and moving stragglers to a supported channel.

What the scanner is actually detecting

Tenable publishes a new plugin in the Windows family every Patch Tuesday, titled Security Updates for Microsoft Office Products C2R (Month Year). Scan reports often merge those monthly plugins with a separate channel check:

The monthly plugins are local checks. Nessus (or Nessus Agent) reads the version Office reports about itself from the registry over an authenticated session and compares it with the first fixed build for that channel. Nothing is exploited. Because Click-to-Run security updates are cumulative, a host showing three consecutive monthly plugins needs one update, not three.

Plugin 97085, which Tenable rates Critical, fires when the installed build belongs to a channel release Microsoft no longer services. The two findings travel together because the root cause is usually the same: the device stopped taking updates, or was parked on a build that has since aged out.

Real-world risk

The CVEs behind the monthly plugins are mostly memory-safety bugs in Office components: use-after-free, heap-based buffer overflow, out-of-bounds read and type confusion flaws. The April 2026 plugin, for example, covers CVE-2026-32190, a use-after-free that allows code execution, and the June 2026 plugin includes a Click-to-Run issue that can elevate privileges. Many carry a “local” attack vector because the code runs when a user opens a crafted file, but delivering that file is ordinary phishing. Mailbox-facing workstations are the real exposure; servers where nobody opens documents carry much less. An unsupported channel is not exploitable by itself, but every future Office fix will skip that device until you move it.

How to confirm it on the host

Read the installed build and channel from the Click-to-Run configuration key:

Get-ItemProperty 'HKLM:SOFTWAREMicrosoftOfficeClickToRunConfiguration' |
  Select-Object VersionToReport, Platform, CDNBaseUrl, UpdateChannel, UpdateUrl, UpdatesEnabled

VersionToReport (format 16.0.xxxxx.yyyyy) is the build to compare with the “fixed version” in the plugin output and with Microsoft’s Update history for Microsoft 365 Apps table. UpdateChannel is a CDN URL whose GUID identifies the channel:

• Current Channel: 492350f6-3a01-4f97-b9c0-c7c6ddf67d60
• Monthly Enterprise Channel: 55336b82-a18d-4dd6-b5f6-9e5095c314a6
• Semi-Annual Enterprise Channel: 7ffbc6bf-bc32-4f92-8982-f9dd17fd3114

Next, check whether policy is holding the device back. Cloud Update policy takes precedence over Group Policy or Intune, which in turn overrides settings written by the Office Deployment Tool (ODT):

Get-ItemProperty 'HKLM:SOFTWAREPoliciesMicrosoftcloudoffice16.0Commonofficeupdate' -ErrorAction SilentlyContinue
Get-ItemProperty 'HKLM:SOFTWAREPoliciesMicrosoftoffice16.0commonofficeupdate' -ErrorAction SilentlyContinue

Look for a pinned target version, automatic updates disabled, an UpdatePath pointing at a share nobody refreshes, or an UpdateBranch naming a channel you did not intend. Finally, confirm the update task exists and ran recently:

Get-ScheduledTask -TaskPath 'MicrosoftOffice' -TaskName 'Office Automatic Updates 2.0' | Select-Object State
Get-ScheduledTaskInfo -TaskPath 'MicrosoftOffice' -TaskName 'Office Automatic Updates 2.0' |
  Select-Object LastRunTime, LastTaskResult

How to fix it

Single machine updating from the Office CDN

Open any Office app and select File > Account > Update Options > Update Now. Remotely, run the scheduled task Microsoft itself documents for this purpose:

schtasks /run /tn "MicrosoftOfficeOffice Automatic Updates 2.0"

Many admins call the Click-to-Run client directly instead:

"C:Program FilesCommon Filesmicrosoft sharedClickToRunOfficeC2RClient.exe" /update user

Treat that as a convenience rather than a documented interface. Microsoft describes OfficeC2RClient.exe as internal to Click-to-Run and says scripted use of its switches is not supported, and Microsoft Q&A threads report that it needs a signed-in user session. Adding forceappshutdown=true closes open Office apps so the update can apply, so warn users about unsaved work first.

Devices held back by Group Policy or Intune

With the Office ADMX templates loaded, open Computer ConfigurationPoliciesAdministrative TemplatesMicrosoft Office 2016 (Machine)Updates and review:

• Enable Automatic Updates: Enabled.
• Target Version: Not Configured, unless you deliberately pin and move the pin every month. A forgotten pin is a classic reason this finding never closes.
• Update Path: empty for the Office CDN, or a share you actually refresh.
• Update Channel: a channel you can keep current.
• Update Deadline: optional; forces installation by a set date.

Intune exposes the same settings in the settings catalog (search for Update Channel and Target Version). After the policy lands, run gpupdate /force on GPO-managed devices and then the Office Automatic Updates 2.0 task.

Devices updating from a network share

If UpdatePath points to a share, Click-to-Run can only install what is in that folder. Refresh it with the ODT each month, using a file that matches the clients’ channel and architecture:

<Configuration>
  <Add SourcePath="\serverofficeupdates" OfficeClientEdition="64" Channel="MonthlyEnterprise">
    <Product ID="O365ProPlusRetail">
      <Language ID="en-us" />
    </Product>
  </Add>
</Configuration>

setup.exe /download download.xml

Configuration Manager

Synchronize the product Microsoft 365 Apps/Office 2019/Office LTSC with the Updates classification, set Enable management of the Office 365 Client Agent to Yes under Client Settings > Software Updates, and deploy the latest build for every channel in use. If Office apps are open during enforcement, ConfigMgr does not close them; the install returns as requiring a restart, and the scanner keeps seeing the old build until that restart happens.

Unsupported channel (plugin 97085)

Move the device to Current Channel or Monthly Enterprise Channel with the Update Channel policy above, the Intune setting, the Microsoft 365 Apps admin center (Inventory > Switch device update channel), or the ODT:

<Configuration>
  <Updates Channel="MonthlyEnterprise" />
</Configuration>

setup.exe /configure channel.xml

The Office Automatic Updates 2.0 task must run twice: once to register the new channel and again to install a build from it. A Group Policy channel setting overrides the ODT, and ConfigMgr cannot move a device from a newer channel to an older one.

Also account for the July 2026 change: starting with Version 2606, devices on Semi-Annual Enterprise Channel receive the same monthly updates as Monthly Enterprise Channel, and SAEC Version 2508 was supported only through September 8, 2026 (Microsoft’s channel unification notes). Any device you deliberately held on 2508 is now unsupported.

Office 2016, 2019 and LTSC Click-to-Run

Volume-licensed Office 2019, LTSC 2021 and LTSC 2024 use their own channels (PerpetualVL2019, PerpetualVL2021, PerpetualVL2024), not the Microsoft 365 Apps channels. Office 2016 and 2019 left support on October 14, 2025, and Office LTSC 2021 reaches end of support on October 13, 2026. Updating these only postpones the finding; plan the move to Microsoft 365 Apps or Office LTSC 2024.

How to verify the fix and rescan

1. Re-run the registry query and confirm VersionToReport is at or above the plugin’s fixed version.
2. Check File > Account in any Office app. After a channel change, the new channel name appears only once a build from that channel is installed.
3. Confirm LastTaskResult for the scheduled task is 0.
4. Rescan with the same credentialed policy. These are local checks, so an unauthenticated scan cannot confirm closure.

If this finding reappears every month, the issue is process rather than the host; tie Office into your monthly Patch Tuesday planning cycle instead of chasing it plugin by plugin.

What can break and how to roll back

• Add-ins and macros: COM and VSTO add-ins or VBA solutions may behave differently on a new build. Pilot with a small group first, using a ring-based deployment.
• Channel moves: moving to a channel with an older version removes features exclusive to the newer one and loses binary delta compression, so the download is larger. Microsoft cites roughly 1.6 GB for the 2508 to 2606 jump.
• Forced shutdown: forceappshutdown and update deadlines close apps, which can lose unsaved work.

To roll back, pin the previous good build from the same channel. Monthly Enterprise Channel supports three months of rollback and Semi-Annual Enterprise Channel two; Microsoft lists rollback as not applicable for Current Channel. Use the Target Version policy or the ODT:

<Configuration>
  <Updates Enabled="TRUE" TargetVersion="16.0.xxxxx.yyyyy" />
</Configuration>

setup.exe /configure rollback.xml

Then run Update Now. A rollback reopens the vulnerabilities the scanner reported, so record it as a time-boxed exception and remove the pin once a fixed build is validated.

Common false positive reasons

• Scan timing: Microsoft advertises new CDN builds gradually over several days, so a scan right after Patch Tuesday may catch hosts not yet offered the build. That is lag rather than a real gap in your process.
• Staged but not applied: the update downloaded but apps were open, or ConfigMgr is waiting for a restart. The finding stays accurate until the build actually switches.
• Channel reporting after unification: since Version 2606, SAEC and Monthly Enterprise share version numbers but use different build numbers, and some tools still label devices as SAEC. Microsoft notes that builds above 20131.20000 have 2606 installed. Verify the build manually before accepting a 97085 result on these devices.
• Leftover configuration: if Office was removed or replaced but the ClickToRun configuration key remains, a scanner can keep reading a stale VersionToReport. Confirm the apps are actually installed before patching a ghost.

FAQ

Why does a new C2R finding appear every month?

Tenable publishes one plugin per Patch Tuesday. Security updates are cumulative and Microsoft offers no security-only downloads for these channels, so installing the current build closes every monthly plugin at once.

Can I run OfficeC2RClient.exe /update user from SYSTEM through an RMM tool?

It is unreliable without a signed-in user, and Microsoft does not support scripted use of the client. For unattended fleets, run the Office Automatic Updates 2.0 task or deploy through ConfigMgr, Intune or Cloud Update.

Does Monthly Enterprise Channel clear plugin 97085?

Yes, as long as the device keeps updating. Each Monthly Enterprise version is supported for three months, and three versions are supported at any time.

Is Semi-Annual Enterprise Channel still an option?

From Version 2606 it updates monthly like Monthly Enterprise, with a two-month rollback window. It no longer gives you a six-month freeze.

Tracking this finding across many hosts

Monthly C2R plugins pile up fast, so track them per host rather than per plugin. SITEY imports findings from 16 scanners, including Nessus results uploaded as .nessus exports, merges duplicates within each scanner, and can retest individual Nessus findings after a fix. Its AI can draft host-specific remediation scripts that run through human approval before its agents deploy them on Windows endpoints, followed by a retest to confirm closure.

Sources

• Tenable: Security Updates for Microsoft Office Products C2R (June 2026), plugin 320866
• Tenable: Microsoft Office Unsupported Channel Version Detection, plugin 97085
• Microsoft Learn: Overview of update channels for Microsoft 365 Apps
• Microsoft Learn: Change the Microsoft 365 Apps update channel
• Microsoft Learn: Manage Microsoft 365 Apps updates with Configuration Manager