Skip to the content
The Update Bureau
SharePoint Server SE SharePoint Server SE Security update
Patch Tuesday

KB5002581

KB5002581: Cumulative update for SharePoint Server, version SE, April 2024. Spoofing flaw closed; Web.config errors and file uploads fixed

In short

The update resolves an Important SharePoint Server spoofing vulnerability and fixes several issues, including oversized Web.config files and failed document-library uploads.

Does it affect you? Applies to: Computers with the release version of SharePoint Server Subscription Edition installed. The update package is for 64-bit systems.

Build
16.0.17328.20246
Security
1 fixed
Restart
Required

What changes

Fixes 5 changes

SharePoint Server

For: SharePoint administrators and users

  • A spoofing vulnerability in SharePoint Server is resolved.1
    CVE-2024-26251.

SharePoint Web.config files

  • Duplicate configuration elements no longer build up in SharePoint Web.config files during upgrades, preventing them from exceeding the configured file-size limit and triggering HTTP 500.19 errors.2
    Removes existing duplicate configuration elements and prevents future duplicates from being added; the size limit is configured in IIS.

List web part

  • The list web part no longer displays only the last property for user columns that have different displayed properties.3

Document library

  • You can upload a new file to a document library when a file with the same name already exists.4

Aggregated newsfeed

  • An unexpected exception in the aggregated newsfeed feature is fixed.5

Improvements 2 changes

Capital city name

  • The capital city of Kazakhstan is named Astana instead of Nur-Sultan.6

Antimalware Scan Interface (AMSI)

  • Antimalware Scan Interface integration is more reliable.7

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2024-04-09
Classification
Security Updates
Type
Cumulative update
Restart
Required
Replaces
KB5002564, KB5002540
Replaced by
KB5002599
VersionBuildChannel
SE 16.0.17328.20246 General availability

Security

1 vulnerability fixed
1 important
VulnerabilitySeverityCVSS
CVE-2024-26251
Microsoft SharePoint Server Spoofing Vulnerability
 Important 6.8

Sources

Updated
Cited passages from Microsoft's official notes (7)
  1. 1. This security update resolves a Microsoft SharePoint Server spoofing vulnerability. To learn more about the vulnerability, see Microsoft Common Vulnerabilities and Exposures CVE-2024-26251. support.microsoft.com
  2. 2. This fix removes the existing duplicate configuration elements and prevents future duplicates from being added. support.microsoft.com
  3. 3. Fixes an issue in which the list web part displays only the last property in all fields that are user columns that have different displayed properties. support.microsoft.com
  4. 4. Fixes an issue in which you cannot upload a new file that has an existing name to the document library. support.microsoft.com
  5. 5. Fixes an unexpected exception in the aggregated newsfeed feature. support.microsoft.com
  6. 6. Changes the name of the capital city of the Republic of Kazakhstan from Nur-Sultan to Astana. support.microsoft.com
  7. 7. Improves the reliability of Antimalware Scan Interface (AMSI) integration. support.microsoft.com
Checked automatically: 8 of 8 checks passed, 7 quoted passages · compared with Microsoft's page on Oct 20, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: passed

A second AI read the text against the sources: correctness 5/5, clarity 4/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake