Skip to the content
The Update Bureau
SharePoint Server 2019 SharePoint Server 2019 Out-of-band security update
Out-of-band Zero-day

KB5002754

KB5002754: Cumulative update for SharePoint Server, version 2019, July 2025. Actively exploited remote-code flaw patched; page loading issue remains

In short

Patches an actively exploited flaw that could let attackers run code on the server. Some page resources might still fail to load; farm administrators have a workaround.

Does it affect you? Applies to: Devices running the release version of SharePoint Server 2019. The SharePoint Server 2019 Language Pack (KB5002753) is also required.

Build
16.0.10417.20037
Security
2 fixed · 1 critical · 1 exploited
Restart
Required

Microsoft ships this release as two packages: KB5002754, the update itself, and KB5002753 for the language packs. Install both on every server of the farm, then run the SharePoint Products Configuration Wizard.

What changes

Fix 1 change

SharePoint Server

  • The update resolves vulnerabilities that could let attackers run code or spoof SharePoint Server.1
    Resolves CVE-2025-53770, a remote code execution vulnerability, and CVE-2025-53771, a spoofing vulnerability.

Known issues

  1. Open Affects: Organizations and IT administrators

    $farm.ContainsGenericAllowedListValue("SignOutRefererAllowList", "<resource path>")

    Some SharePoint page resources might fail to load, and ULS logs might show an access denied message.2

    How to apply the workaround SharePoint Management Shell

    Add the valid resource path to the AllowList, then restart IIS.2

    Step-by-step instructions, command & download kit
    2 steps SharePoint Management Shell Instructions (.txt)
    Show steps & kit Hide steps & kit
    Step-by-step procedure
    1. Make sure the resource path is valid and as expected.
    2. Run the commands in SharePoint Management Shell.
    SharePoint Management Shell 
    > $farm = get-spfarm> $farm.AddGenericAllowedListValue("SignOutRefererAllowList", "<resource path>")> $farm.Update()> iisreset
  2. Open Affects: Organizations and IT administrators

    $farm.RemoveGenericAllowedListValue("SignOutRefererAllowList", "<resource path>")

    Some SharePoint page resources might fail to load, and ULS logs might show an access denied message.2

    How to apply the workaround SharePoint Management Shell

    Add the valid resource path to the AllowList, then restart IIS.2

    Step-by-step instructions, command & download kit
    2 steps SharePoint Management Shell Instructions (.txt)
    Show steps & kit Hide steps & kit
    Step-by-step procedure
    1. Make sure the resource path is valid and as expected.
    2. Run the commands in SharePoint Management Shell.
    SharePoint Management Shell 
    > $farm = get-spfarm> $farm.AddGenericAllowedListValue("SignOutRefererAllowList", "<resource path>")> $farm.Update()> iisreset

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2025-07-21
Classification
Security Updates
Type
Cumulative update
Restart
Required
Replaces
KB5002741
Replaced by
KB5002769
VersionBuildChannel
2019 16.0.10417.20037 General availability

Security

2 vulnerabilities fixed
1 exploited 1 critical 1 important
VulnerabilitySeverityCVSS
CVE-2025-53770 Exploited
Microsoft SharePoint Server Remote Code Execution Vulnerability
 Critical 9.8
CVE-2025-53771
Microsoft SharePoint Server Spoofing Vulnerability
 Important 6.5

Updated components

582 files changed since the previous update for the same versions.

Top changed componentsFiles
Search44
Project Server23
Document conversion20
Client object model9
Access Services8
Document management and policies6
Managed metadata3
Office web apps3
PowerPoint3
PowerShell2
Publishing2
Translation Services2

Sources

Updated
Cited passages from Microsoft's official notes (2)
  1. 1. This security update resolves a Microsoft SharePoint Server remote code execution vulnerability and Microsoft SharePoint Server spoofing vulnerability. support.microsoft.com
  2. 2. Users may experience an issue when loading some SharePoint page resources, and the following error message is logged in the SharePoint Unified Logging System (ULS) logs: support.microsoft.com
Checked automatically: 7 of 8 checks passed, 2 quoted passages · compared with Microsoft's page on Nov 8, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: not passed

A second AI read the text against the sources: correctness 5/5, clarity 4/5, completeness 4/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake