The Update BureauKB5002744: Cumulative update for SharePoint Server, version 2016, July 2025. Critical remote-code execution flaws in Word and server code
Addresses four vulnerabilities, including two critical remote-code execution flaws affecting Word and the server. The update can request a restart.
Does it affect you? Applies to: SharePoint Server 2016. The update produces build 16.0.5508.1000.
Review notes Additional details from the official release notes (1) Read note
- This page MSRC rates the update Critical, while WSUS and the Microsoft Update Catalog rate it Important.
The official sources are linked at the end of the page.
Microsoft ships this release as two packages: KB5002744, the update itself, and KB5002743 for the language packs. Install both on every server of the farm, then run the SharePoint Products Configuration Wizard.
In detail
- Security Addresses four vulnerabilities: two critical and two important. The critical flaws are CVE-2025-49703, a Word remote-code execution vulnerability, and CVE-2025-49704, a SharePoint remote-code execution vulnerability.
Technical details
Data sheet · Security · Downloads · Components Click to collapse or expand
Data sheet
- Released
- 2025-07-08
- Classification
- Security Updates
- Type
- Cumulative update
- Restart
- Required
- Replaced by
- KB5002760
| Version | Build | Channel |
|---|---|---|
| 2016 | 16.0.5508.1000 | General availability |
Security
| Vulnerability | Severity | CVSS |
|---|---|---|
|
Microsoft SharePoint Remote Code Execution Vulnerability
|
Critical | 8.8 |
|
Microsoft Word Remote Code Execution Vulnerability
|
Critical | 7.8 |
|
Microsoft SharePoint Remote Code Execution Vulnerability
|
Important | 8.8 |
|
Microsoft SharePoint Server Spoofing Vulnerability
|
Important | 6.5 |
Downloads (Microsoft Update Catalog)
Language packs (51)
- Arabic (Saudi Arabia)
- Azerbaijani (Latin, Azerbaijan)
- Basque (Spain)
- Bosnian (Latin, Bosnia & Herzegovina)
- Bulgarian (Bulgaria)
- Catalan (Spain)
- Chinese (China)
- Chinese (Taiwan)
- Croatian (Croatia)
- Czech (Czechia)
- Danish (Denmark)
- Dari (Afghanistan)
- Dutch (Netherlands)
- English (United States)
- Estonian (Estonia)
- Finnish (Finland)
- French (France)
- Galician (Spain)
- German (Germany)
- Greek (Greece)
- Hebrew (Israel)
- Hindi (India)
- Hungarian (Hungary)
- Indonesian (Indonesia)
- Irish (Ireland)
- Italian (Italy)
- Japanese (Japan)
- Kazakh (Kazakhstan)
- Korean (South Korea)
- Latvian (Latvia)
- Lithuanian (Lithuania)
- Macedonian (North Macedonia)
- Malay (Malaysia)
- Norwegian Bokmål (Norway)
- Polish (Poland)
- Portuguese (Brazil)
- Portuguese (Portugal)
- Romanian (Romania)
- Russian (Russia)
- Serbian (Cyrillic, Serbia)
- Serbian (Latin, Serbia)
- Serbian (Latin, Serbia)
- Slovak (Slovakia)
- Slovenian (Slovenia)
- Spanish (Spain)
- Swedish (Sweden)
- Thai (Thailand)
- Turkish (Türkiye)
- Ukrainian (Ukraine)
- Vietnamese (Vietnam)
- Welsh (United Kingdom)
Sources
Checked automatically: 7 of 8 checks passed · compared with Microsoft's page on Nov 8, 2026
- Quotes found in the official pages: passed
- Numbers found in the sources: passed
- Vulnerabilities from the dossier only: passed
- Links to allowed domains only: passed
- Every official change covered: passed
- Readable plain text: passed
- Changes confirmed by the file list: passed
- Sources agree: not passed
A second AI read the text against the sources: correctness 4/5, clarity 5/5, completeness 4/5. How we work
Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake