The Update BureauKB5002599: Cumulative update for SharePoint Server, version SE, May 2024. Critical remote-code execution and information-disclosure flaws fixed
In short
The update fixes two SharePoint Server vulnerabilities, including a critical remote-code-execution flaw, and resolves six issues affecting farm setup, search, tags, links, events, and list updates.
Does it affect you? Applies to: Devices with the release version of SharePoint Server Subscription Edition installed. The update package is for 64-bit systems.
What changes
Fixes 6 changes
SharePoint farm
-
You can add a new server to an existing farm even when the farm uses a certificate managed by Certificate Management.1
Fixes adding a server to an existing SharePoint farm when it contains a certificate managed by the Certificate Management feature.
Modern search page
-
Office documents open in Office Online when you select them in search results, instead of downloading.2
Fixes Office documents downloading instead of opening in Office Online when selected from modern search results.
Managed metadata
-
The tag dialog opens when you select Add Tag in the details pane.3
Fixes the tag dialog not opening for the Managed metadata column field in the details pane.
Quick links web part
-
Changing an external link to an internal link stops it from opening in a new browser tab.4
Fixes the Quick links web part continuing to open a link in a new browser tab after it is changed from external to internal.
Events web part
-
You can open an event with an attachment from the Events web part on a modern page.5
Fixes opening an event item with an attachment in the Events web part on a modern page.
Modern UI
-
Changes to list items appear without needing to refresh the page.6
Fixes list item updates not appearing in the modern UI until the page is refreshed.
Technical details
Data sheet · Security · Downloads · Components Click to collapse or expand
Data sheet
- Released
- 2024-05-14
- Classification
- Security Updates
- Type
- Cumulative update
- Restart
- Required
- Replaces
- KB5002581, KB5002564, KB5002540
- Replaced by
- KB5002603
| Version | Build | Channel |
|---|---|---|
| SE | 16.0.17328.20292 | General availability |
Security
| Vulnerability | Severity | CVSS |
|---|---|---|
|
Microsoft SharePoint Server Remote Code Execution Vulnerability
|
Critical | 7.2 |
|
Microsoft SharePoint Server Information Disclosure Vulnerability
|
Important | 6.5 |
Downloads (Microsoft Update Catalog)
Package
SE
1.5 GB
sts-x-none.cab
Language packs (49)
- Arabic (Saudi Arabia)
- Azerbaijani (Latin, Azerbaijan)
- Basque (Spain)
- Bosnian (Latin, Bosnia & Herzegovina)
- Bulgarian (Bulgaria)
- Catalan (Spain)
- Chinese (China)
- Chinese (Taiwan)
- Croatian (Croatia)
- Czech (Czechia)
- Danish (Denmark)
- Dutch (Netherlands)
- English (United States)
- Estonian (Estonia)
- Finnish (Finland)
- French (France)
- Galician (Spain)
- German (Germany)
- Greek (Greece)
- Hebrew (Israel)
- Hindi (India)
- Hungarian (Hungary)
- Indonesian (Indonesia)
- Irish (Ireland)
- Italian (Italy)
- Japanese (Japan)
- Kazakh (Kazakhstan)
- Korean (South Korea)
- Latvian (Latvia)
- Lithuanian (Lithuania)
- Macedonian (North Macedonia)
- Malay (Malaysia)
- Norwegian Bokmål (Norway)
- Polish (Poland)
- Portuguese (Brazil)
- Portuguese (Portugal)
- Romanian (Romania)
- Russian (Russia)
- Serbian (Cyrillic, Serbia)
- Serbian (Latin, Serbia)
- Slovak (Slovakia)
- Slovenian (Slovenia)
- Spanish (Spain)
- Swedish (Sweden)
- Thai (Thailand)
- Turkish (Türkiye)
- Ukrainian (Ukraine)
- Vietnamese (Vietnam)
- Welsh (United Kingdom)
Sources
Updated
Cited passages from Microsoft's official notes (6)
-
1.
Fixes an issue in which you cannot add a new server to an existing SharePoint farm if the farm contains a certificate that's managed by the Certificate Management feature.
support.microsoft.com -
2.
Fixes an issue in which Microsoft Office documents are downloaded instead of being opened in Office Online when you select search results on the modern search page.
support.microsoft.com -
3.
Fixes an issue in which the tag dialog box doesn’t open when you select the Add Tag icon for the Managed metadata column field in the details pane.
support.microsoft.com -
4.
Fixes an issue in which the Quick links web part still opens the link on a new browser tab when you change an external link to an internal link.
support.microsoft.com -
5.
Fixes an issue in which you cannot open an event item that has an attachment in the Events web part on a modern page.
support.microsoft.com -
6.
Fixes an issue in which updates to list items do not appear in the modern UI until the page is refreshed.
support.microsoft.com
Checked automatically: 8 of 8 checks passed, 6 quoted passages · compared with Microsoft's page on Oct 20, 2026
- Quotes found in the official pages: passed
- Numbers found in the sources: passed
- Vulnerabilities from the dossier only: passed
- Links to allowed domains only: passed
- Every official change covered: passed
- Readable plain text: passed
- Changes confirmed by the file list: passed
- Sources agree: passed
A second AI read the text against the sources: correctness 5/5, clarity 5/5, completeness 5/5. How we work
Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake