KB5002658: Cumulative update for SharePoint Server, version SE, December 2024. Remote code execution and privilege flaws fixed alongside page issues

The update addresses four Important security vulnerabilities, including remote code execution and elevation of privilege, and fixes four SharePoint page and upload problems.

Does it affect you? Applies to: SharePoint Server Subscription Edition servers running the release version of the product. The package is for x64.

What changes

Fixes 4 changes

SPSerialization

Pages with third-party web parts or controls load successfully when SPSerialization is restricted using the new allow-list mechanism.¹
Fixes the issue where restricting SPSerialization with the new allow-list mechanism prevented those pages from loading.

Command bar

Command bar elements no longer disappear when you zoom the browser in or out.²

Folder upload

You can upload folders whose names contain similar characters from the extended range of supported characters.³

Hero web part

Reordering tiles in the Hero web part works again.⁴

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released: 2024-12-10
Classification: Security Updates
Type: Cumulative update
Restart: Required
Replaces: KB5002651, KB5002649, KB5002640, KB5002606

+5 earlier
KB5002603, KB5002599, KB5002581, KB5002564, KB5002540
Replaced by: KB5002676

Version	Build	Channel
SE	16.0.17928.20290	General availability

Security

4 vulnerabilities fixed

4 important

Vulnerability	Severity	CVSS
CVE-2024-49068 Microsoft SharePoint Elevation of Privilege Vulnerability	Important	8.2
CVE-2024-49070 Microsoft SharePoint Remote Code Execution Vulnerability	Important	7.4
CVE-2024-49062 Microsoft SharePoint Information Disclosure Vulnerability	Important	6.5
CVE-2024-49064 Microsoft SharePoint Information Disclosure Vulnerability	Important	6.5

Downloads (Microsoft Update Catalog)

Package SE

1.5 GB

sts-x-none.cab Main update · KB5002658 SHA-1: 7d349ff1…2d4bd9

Language packs (49)

Sources

Updated Oct 27, 2026

Cited passages from Microsoft's official notes (4)

1. Fixes an issue that affects restricting SPSerialization by using a new allow list mechanism. This cause pages that have third-party web parts or controls not to load successfully. support.microsoft.com
2. Fixes an issue in which UI elements of the command bar disappear when you zoom in or zoom out the browser. support.microsoft.com
3. Fixes an issue in which you cannot upload folders if the folder name contains similar characters from an extended range of supported characters. support.microsoft.com
4. Fixes an issue where reordering the tile in the Hero web part doesn't work. support.microsoft.com

Checked automatically: 8 of 8 checks passed, 4 quoted passages · compared with Microsoft's page on Oct 20, 2026

Quotes found in the official pages: passed
Numbers found in the sources: passed
Vulnerabilities from the dossier only: passed
Links to allowed domains only: passed
Every official change covered: passed
Readable plain text: passed
Changes confirmed by the file list: passed
Sources agree: passed

A second AI read the text against the sources: correctness 5/5, clarity 4/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake