The Update BureauKB5002709: Cumulative update for SharePoint Server, version SE, May 2025. Remote code execution and privilege escalation flaws fixed
In short
Resolves four Important security vulnerabilities in SharePoint Server, including remote code execution and elevation of privilege flaws. It also adds hybrid search support and fixes four SharePoint issues.
Does it affect you? Applies to: Devices running the release version of SharePoint Server Subscription Edition. The update package is for x64 systems.
What changes
Fixes 4 changes
Quick Links modern web parts
- Quick Links modern web parts no longer break when Zero Downtime patching is used with the Side-by-Side token.1
My Site authentication
For: users without permissions to followed sites
- Users are no longer repeatedly prompted for My Site authentication when they do not have permissions to the followed sites.2
User Information list
- Users can filter the list when it contains an indexed column and has more than 500 items.3
Data Loss Prevention
For: users of SharePoint subsites
- Data Loss Prevention policy tips work on SharePoint subsites.4
New features 2 changes
Hybrid search
-
A new command supports retrieving the VroomId in hybrid search scenarios.5
Introduces
Get-SPHybridDocVroomId.
Hybrid Search
-
Hybrid Search is scheduled to become available in the Standard release ring. A script onboards the new Hybrid Search Experience process.6
Download and run
Onboard-CloudHybridSearch-SPOONS.ps1to onboard the new process.
Improvement 1 change
Search Content Service
- Search Content Service (SCS) is scheduled to retire on June 30, 2025.7
Technical details
Data sheet · Security · Downloads · Components Click to collapse or expand
Data sheet
- Released
- 2025-05-13
- Classification
- Security Updates
- Type
- Cumulative update
- Restart
- Required
- Replaces
- KB5002705, KB5002681, KB5002676, KB5002658
- Replaced by
- KB5002736
| Version | Build | Channel |
|---|---|---|
| SE | 16.0.18526.20286 | General availability |
Security
| Vulnerability | Severity | CVSS |
|---|---|---|
|
Microsoft SharePoint Server Elevation of Privilege Vulnerability
|
Important | 7.8 |
|
Microsoft SharePoint Server Remote Code Execution Vulnerability
|
Important | 7.8 |
|
Microsoft SharePoint Server Remote Code Execution Vulnerability
|
Important | 7.4 |
|
Microsoft SharePoint Server Remote Code Execution Vulnerability
|
Important | 7.0 |
Downloads (Microsoft Update Catalog)
Package
SE
1.5 GB
sts-x-none.cab
Language packs (49)
- Arabic (Saudi Arabia)
- Azerbaijani (Latin, Azerbaijan)
- Basque (Spain)
- Bosnian (Latin, Bosnia & Herzegovina)
- Bulgarian (Bulgaria)
- Catalan (Spain)
- Chinese (China)
- Chinese (Taiwan)
- Croatian (Croatia)
- Czech (Czechia)
- Danish (Denmark)
- Dutch (Netherlands)
- English (United States)
- Estonian (Estonia)
- Finnish (Finland)
- French (France)
- Galician (Spain)
- German (Germany)
- Greek (Greece)
- Hebrew (Israel)
- Hindi (India)
- Hungarian (Hungary)
- Indonesian (Indonesia)
- Irish (Ireland)
- Italian (Italy)
- Japanese (Japan)
- Kazakh (Kazakhstan)
- Korean (South Korea)
- Latvian (Latvia)
- Lithuanian (Lithuania)
- Macedonian (North Macedonia)
- Malay (Malaysia)
- Norwegian Bokmål (Norway)
- Polish (Poland)
- Portuguese (Brazil)
- Portuguese (Portugal)
- Romanian (Romania)
- Russian (Russia)
- Serbian (Cyrillic, Serbia)
- Serbian (Latin, Serbia)
- Slovak (Slovakia)
- Slovenian (Slovenia)
- Spanish (Spain)
- Swedish (Sweden)
- Thai (Thailand)
- Turkish (Türkiye)
- Ukrainian (Ukraine)
- Vietnamese (Vietnam)
- Welsh (United Kingdom)
Sources
Updated
Cited passages from Microsoft's official notes (7)
-
1.
Fixes an issue in which Quick Links modern web parts might break when you use Zero Downtime patching (ZDP) together with the Side-by-Side token.
support.microsoft.com -
2.
Fixes an issue in which users are prompted repeatedly for My Site authentication if they don't have permissions to the followed sites.
support.microsoft.com -
3.
Fixes an issue in which users can't filter the User Information list if the list contains the indexed column and exceeds 500 items.
support.microsoft.com -
4.
Fixes an issue in which Data Loss Prevention (DLP) policy tips don't work on SharePoint subsites.
support.microsoft.com -
5.
Introduces the
support.microsoft.comGet-SPHybridDocVroomIdcommand to support retrieving VroomId in the hybrid search scenario. -
6.
The new Hybrid Search feature will be available in the Standard release ring. Download and run the Onboard-CloudHybridSearch-SPOONS.ps1 script to onboard the new Hybrid Search Experience process.
support.microsoft.com -
7.
SCS (Search Content Service) will be retired on June 30, 2025.
support.microsoft.com
Checked automatically: 8 of 8 checks passed, 7 quoted passages · compared with Microsoft's page on Oct 20, 2026
- Quotes found in the official pages: passed
- Numbers found in the sources: passed
- Vulnerabilities from the dossier only: passed
- Links to allowed domains only: passed
- Every official change covered: passed
- Readable plain text: passed
- Changes confirmed by the file list: passed
- Sources agree: passed
A second AI read the text against the sources: correctness 4/5, clarity 5/5, completeness 5/5. How we work
Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake