Skip to the content
The Update Bureau
SharePoint Server SE SharePoint Server SE Security update
Patch Tuesday

KB5002640

KB5002640: Cumulative update for SharePoint Server, version SE, September 2024. Critical code-execution and denial-of-service flaws addressed

In short

The update resolves five vulnerabilities, including two critical remote-code-execution flaws and a denial-of-service flaw. It also introduces Version 24H2 and leaves open an issue that can block workflow publishing.

Does it affect you? Applies to: This update is for the release version of SharePoint Server Subscription Edition on x64 systems.

Build
16.0.17928.20086
Security
5 fixed · 2 critical
Restart
Required

What changes

Fixes 6 changes

Lookup columns

  • Lookup columns that get data from a date-time column show the correct data when the view also contains a JSON-formatted column.1

Business data connectivity

  • Business data connectivity features work correctly after the latest .NET cumulative updates are installed.2
    Applies to business data connectivity (BDC) features.

My Site

  • Users without permissions to followed sites are no longer repeatedly prompted to authenticate to My Site.3

Grouped list view

  • A grouped list view on a required field remains grouped in page navigation mode.4

List web part

  • The list web part displays the correct values for users when the user column allows multiple values.5

Search

  • CPU usage is reduced during the search process.6

Improvement 1 change

Logging

  • Logging provides more information about the invalid URL field schema.7

New feature 1 change

SharePoint Server Subscription Edition Version 24H2

  • The Version 24H2 feature update is included, and future public updates will include it too.8

Removal 1 change

Basic authentication

  • You can no longer configure Basic authentication for new or existing web apps through Central Administration or PowerShell. Existing web apps should continue to work.9
    The change is intentional and is part of the deprecation of Basic authentication in SharePoint Server Subscription Edition.

Known issues

  1. Open Affects: Organizations and IT administrators

    After you apply this update, you might experience an issue that affects the deserialization of custom types that inherit from IDictionary.

    After installing the update, deserialization of custom types that inherit from IDictionary might be affected.10

    Workaround status No workaround yet

    Microsoft has not published a manual workaround for this issue yet. Monitor release health until a resolving update is available.

  2. Open Affects: Organizations and IT administrators

    You might experience an issue in which SharePoint workflows can't be published because the unauthorized type is blocked.

    SharePoint workflows might not publish when an unauthorized type is blocked. The issue also generates event tag c42q0 in SharePoint ULS logs.11

    How to apply the workaround Workaround

    Find the blocked type using event tag c42q0; if the type and assembly are safe, add the type to the authorized list in Web.config.11

    Step-by-step workaround instructions
    2 steps
    Show steps Hide steps
    Step-by-step procedure
    1. Search the SharePoint ULS logs for event tag c42q0 to find the blocked type.
    2. If the type and assembly are safe, add the type to the authorized list in Web.config.
  3. Open Affects: Organizations and IT administrators

    While Basic authentication for existing web applications should continue to work, you will no longer be able to configure Basic authentication for new or existing web apps through Central Administration or PowerShell.

    Existing web apps using Basic authentication should continue to work, but you can no longer configure it for new or existing web apps through Central Administration or PowerShell. This intentional change is part of Basic authentication's deprecation.9

    Workaround status No workaround yet

    Microsoft has not published a manual workaround for this issue yet. Monitor release health until a resolving update is available.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2024-09-10
Classification
Security Updates
Type
Cumulative update
Restart
Required
Replaces
KB5002606, KB5002603, KB5002599, KB5002581
+2 earlier KB5002564, KB5002540
Replaced by
KB5002649
VersionBuildChannel
SE 16.0.17928.20086 General availability

Security

5 vulnerabilities fixed
2 critical 3 important
VulnerabilitySeverityCVSS
CVE-2024-38018
Microsoft SharePoint Server Remote Code Execution Vulnerability
 Critical 8.8
CVE-2024-43464
Microsoft SharePoint Server Remote Code Execution Vulnerability
 Critical 7.2
CVE-2024-38227
Microsoft SharePoint Server Remote Code Execution Vulnerability
 Important 7.2
CVE-2024-38228
Microsoft SharePoint Server Remote Code Execution Vulnerability
 Important 7.2
CVE-2024-43466
Microsoft SharePoint Server Denial of Service Vulnerability
 Important 6.5

Sources

Updated
Cited passages from Microsoft's official notes (11)
  1. 1. Fixes an issue in which the lookup column that gets its data from a date-time column is incorrect if a JSON-formatted column exists in the view. support.microsoft.com
  2. 2. Fixes an issue in which the business data connectivity (BDC) features don't work correctly after you install the latest .NET cumulative updates. support.microsoft.com
  3. 3. Fixes an issue in which My Site authentication is prompted repeatedly when a user doesn't have permissions to the followed sites. support.microsoft.com
  4. 4. Fixes an issue in which the grouped list view on a required field is displayed as not grouped when in page navigation mode. support.microsoft.com
  5. 5. Fixes an issue in which the list web part doesn't display the correct values for users if the user column is multi-value. support.microsoft.com
  6. 6. Fixes an issue of high CPU usage during search process. support.microsoft.com
  7. 7. Improves logging for the invalid URL field schema. support.microsoft.com
  8. 8. This security update introduces the SharePoint Server Subscription Edition Version 24H2 feature update. This feature update will be included in all SharePoint Server Subscription Edition public updates going forward. support.microsoft.com
  9. 9. While Basic authentication for existing web applications should continue to work, you will no longer be able to configure Basic authentication for new or existing web apps through Central Administration or PowerShell. support.microsoft.com
  10. 10. After you apply this update, you might experience an issue that affects the deserialization of custom types that inherit from IDictionary. support.microsoft.com
  11. 11. To work around this issue, register the safe types in the Web.config file. You can look for event tag "c42q0" in ULS logs to find the blocked type. support.microsoft.com
Checked automatically: 7 of 8 checks passed, 11 quoted passages · compared with Microsoft's page on Oct 20, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: not passed

A second AI read the text against the sources: correctness 5/5, clarity 4/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake