KB5002736: Cumulative update for SharePoint Server, version SE, June 2025. Critical remote-code flaw fixed; Hybrid Search flight remains blocked

The update fixes three vulnerabilities, including one Critical remote-code execution flaw, CVE-2025-47172. The new Hybrid Search flight still is not enabled in the Standard release ring; support can provide a workaround.

Does it affect you? Applies to: Devices running the release version of SharePoint Server Subscription Edition. The update package is for x64.

What changes

Fixes 9 changes

Asynchronous SQL session

Repeated calls no longer produce an error saying EndExecuteNonQuery cannot be called more than once for the same execution.¹
Fixes the error when calling EndExecuteNonQuery multiple times in an asynchronous SQL session.

Search schema

Loading the search schema from SharePoint Central Administration no longer produces a “server tag is not well formed” error.²

SharePoint Lists REST API

The Attachments Boolean property is returned again when you use the SharePoint Lists REST API.³

Share Site dialog

The spinning circle disappears after you share a site from the homepage.⁴

Folder downloads

Downloaded folders containing Traditional Chinese characters no longer show garbled text because of an encoding issue.⁵

SQL connection strings

The compatibility issue between the two SQL client libraries is fixed.⁶
Fixes compatibility between System.Data.SqlClient and Microsoft.Data.SqlClient.

Text web part

Bold text displays in the text web part after the Microsoft Edge 135 update.⁷

Distributed Cache service

The Distributed Cache service starts after slipstream installations.⁸

Communication sites

The search box is aligned correctly on communication sites.⁹

Improvements 2 changes

Hybrid Search

2 items

The update supports a configuration for the hybrid search endpoint; use the latest onboarding script to try this update.¹⁰
The script is Onboard-CloudHybridSearch-SPOONS.ps1; the configuration is GraphEndpointHost.
Customers must use the new hybrid search endpoint.¹¹

New feature 1 change

List web part

A setting lets you hide the command bar in the List web part.¹²

Known issues

Open Affects: Organizations and IT administrators

The flight for the new Hybrid Search feature in the Standard release ring was not enabled successfully in the May update, please contact the support team to get the workaround to enable the flight.

The new Hybrid Search flight was not enabled successfully in the Standard release ring in the May update. Contact support for the workaround to enable it.¹³

How to apply the workaround Workaround

Contact the support team to get the workaround for enabling the flight.¹³

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released: 2025-06-10
Classification: Security Updates
Type: Cumulative update
Restart: Required
Replaces: KB5002709, KB5002705, KB5002681, KB5002676

+10 earlier
KB5002658, KB5002651, KB5002649, KB5002640, KB5002606, KB5002603, KB5002599, KB5002581, KB5002564, KB5002540
Replaced by: KB5002751

Version	Build	Channel
SE	16.0.18526.20396	General availability

Security

3 vulnerabilities fixed

1 critical 2 important

Vulnerability	Severity	CVSS
CVE-2025-47172 Microsoft SharePoint Server Remote Code Execution Vulnerability	Critical	8.8
CVE-2025-47163 Microsoft SharePoint Server Remote Code Execution Vulnerability	Important	8.8
CVE-2025-47166 Microsoft SharePoint Server Remote Code Execution Vulnerability	Important	8.8

Downloads (Microsoft Update Catalog)

Package SE

1.5 GB

sts-x-none.cab Main update · KB5002736 SHA-1: 5942cff7…496a6e

Language packs (49)

Sources

Microsoft Support: KB5002736

Updated Oct 27, 2026

Cited passages from Microsoft's official notes (13)

1. Fixes an issue in which you receive the following error message when you try to call EndExecuteNonQuery multiple times in asynchronous SQL session: support.microsoft.com
2. Fixes an issue in which you receive the following error message when you load the search schema from the SharePoint Central Administration page: support.microsoft.com
3. Fixes an issue in which the Attachments Boolean property is no longer returned when calling the SharePoint Lists REST API. support.microsoft.com
4. Fixes an issue in which the spinning circle on the Share Site dialog doesn't disappear when you share a site from the homepage. support.microsoft.com
5. Fixes an encoding issue that causes mojibake when you download folders containing Traditional Chinese characters. support.microsoft.com
6. Fixes the SQL connection string compatibility issue between System.Data.SqlClient and Microsoft.Data.SqlClient. support.microsoft.com
7. Fixes an issue in which the text web part doesn't display bold text after the Microsoft Edge 135 update. support.microsoft.com
8. Fixes an issue in which the Distributed Cache service doesn't start after slipstream installations. support.microsoft.com
9. Fixes an issue in which the search box is misaligned on communication sites. support.microsoft.com
10. To Support the GraphEndpointHost configuration, please download the latest version of Onboard-CloudHybridSearch-SPOONS.ps1 script to try this update. support.microsoft.com
11. Requires customers to use the new hybrid search endpoint. support.microsoft.com
12. Provides a setting to hide the command bar in the List web part. support.microsoft.com
13. The flight for the new Hybrid Search feature in the Standard release ring was not enabled successfully in the May update, please contact the support team to get the workaround to enable the flight. support.microsoft.com

Checked automatically: 7 of 8 checks passed, 13 quoted passages · compared with Microsoft's page on Oct 20, 2026

Quotes found in the official pages: passed
Numbers found in the sources: passed
Vulnerabilities from the dossier only: passed
Links to allowed domains only: passed
Every official change covered: passed
Readable plain text: passed
Changes confirmed by the file list: passed
Sources agree: not passed

A second AI read the text against the sources: correctness 5/5, clarity 4/5, completeness 4/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake