KB5002681: Cumulative update for SharePoint Server, version SE, February 2025. Remote code execution flaw closed; four list problems fixed

The update resolves a SharePoint Server remote code execution vulnerability and fixes four problems with list displays, account validation, and creating list items.

Does it affect you? Applies to: Computers running the release version of SharePoint Server Subscription Edition.

What changes

Fixes 4 changes

Computed columns

In modern lists, computed columns show their actual values instead of IDs when the fields are not visible.¹
Applies to managed metadata, person, and lookup columns in the list item display form.

Information panel

The information panel validates Windows accounts in Person columns when a web application uses multiple authentication modes.²

Date column

Date columns show the correct value instead of “30.12.1899” when a list contains a column with custom formatting.³

Personal sites

You can create list items from personal sites.⁴

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released: 2025-02-11
Classification: Security Updates
Type: Cumulative update
Restart: Required
Replaces: KB5002676, KB5002658, KB5002651, KB5002649

+7 earlier
KB5002640, KB5002606, KB5002603, KB5002599, KB5002581, KB5002564, KB5002540
Replaced by: KB5002705

Version	Build	Channel
SE	16.0.17928.20396	General availability

Security

1 vulnerability fixed

1 important

Vulnerability	Severity	CVSS
CVE-2025-21400 Microsoft SharePoint Server Remote Code Execution Vulnerability	Important	8.0

Downloads (Microsoft Update Catalog)

Package SE

1.5 GB

sts-x-none.cab Main update · KB5002681 SHA-1: 769049e0…2c38d6

Language packs (49)

Sources

Updated Oct 27, 2026

Cited passages from Microsoft's official notes (4)

1. Fixes an issue in which computed columns (such as managed metadata, person, and lookup) show an ID instead of the actual value in the list item display form of modern lists if the field is not visible. support.microsoft.com
2. Fixes an issue in which the information panel doesn't validate Windows accounts that are set in the Person column if the web application has multiple authentication modes. support.microsoft.com
3. Fixes an issue in which the Date column shows "30.12.1899" instead of the correct value if the list contains any column that use custom formatting. support.microsoft.com
4. Fixes an issue in which you cannot create list items from personal sites. support.microsoft.com

Checked automatically: 8 of 8 checks passed, 4 quoted passages · compared with Microsoft's page on Oct 20, 2026

Quotes found in the official pages: passed
Numbers found in the sources: passed
Vulnerabilities from the dossier only: passed
Links to allowed domains only: passed
Every official change covered: passed
Readable plain text: passed
Changes confirmed by the file list: passed
Sources agree: passed

A second AI read the text against the sources: correctness 5/5, clarity 4/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake