Skip to the content
The Update Bureau
SharePoint Server 2016 SharePoint Server 2016 Out-of-band security update
Out-of-band Zero-day

KB5002760

KB5002760: Cumulative update for SharePoint Server, version 2016, July 2025. Critical remote-code flaw under attack; page resources may fail

In short

A critical remote-code flaw under active attack is fixed. Some SharePoint page resources might still fail to load, and the update includes a workaround.

Does it affect you? Applies to: Devices running the release version of SharePoint Server 2016. The update package is for x64 systems.

Build
16.0.5513.1001
Security
2 fixed · 1 critical · 1 exploited
Restart
Required

Microsoft ships this release as two packages: KB5002760, the update itself, and KB5002759 for the language packs. Install both on every server of the farm, then run the SharePoint Products Configuration Wizard.

What changes

New features 7 changes

SharePoint Framework (SPFx)

For: business

  • SharePoint Server 2016 gains the SharePoint Framework.1

Administrative Actions Logging

  • SharePoint Server 2016 gains Administrative Actions Logging.2

MinRole enhancements

  • SharePoint Server 2016 gains MinRole enhancements.3

SharePoint Custom Tiles

For: business

  • SharePoint Server 2016 gains SharePoint Custom Tiles.4

Hybrid Taxonomy

For: business

  • SharePoint Server 2016 gains Hybrid Taxonomy.5

OneDrive API for SharePoint on-premises

For: business

  • SharePoint Server 2016 gains the OneDrive API for on-premises use.6

OneDrive for Business modern user experience

  • Eligible customers gain the modern OneDrive for Business experience.7
    Requires an active Software Assurance contract when enabled, either through the update or manual enablement. Without an active contract at enablement, turn off the experience.

Fix 1 change

SharePoint Server

For: business

  • The update resolves a remote-code execution flaw and a spoofing flaw.8
    Build 16.0.5513.1001.

Known issues

  1. Open Affects: Organizations and IT administrators

    $farm.ContainsGenericAllowedListValue("SignOutRefererAllowList", "<resource path>")

    Some SharePoint page resources might not load, and an Access Denied message might appear in the logs.9

    How to apply the workaround SharePoint Management Shell

    Adding the resource path to the AllowList lets the affected page resource load.9

    Step-by-step instructions, command & download kit
    2 steps SharePoint Management Shell Instructions (.txt)
    Show steps & kit Hide steps & kit
    Step-by-step procedure
    1. Make sure the resource path is valid and as expected.
    2. In SharePoint Management Shell, add the resource path to the AllowList, update the farm, and run iisreset.
    SharePoint Management Shell 
    > $farm = get-spfarm> $farm.AddGenericAllowedListValue("SignOutRefererAllowList", "<resource path>")> $farm.Update()> iisreset
  2. Open Affects: Organizations and IT administrators

    $farm.RemoveGenericAllowedListValue("SignOutRefererAllowList", "<resource path>")

    Farm administrators can remove a resource path from the AllowList with the documented command.10

    Workaround status No workaround yet

    Microsoft has not published a manual workaround for this issue yet. Monitor release health until a resolving update is available.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2025-07-21
Classification
Security Updates
Type
Cumulative update
Restart
Required
Replaces
KB5002744
Replaced by
KB5002771
VersionBuildChannel
2016 16.0.5513.1001 General availability

Security

2 vulnerabilities fixed
1 exploited 1 critical 1 important
VulnerabilitySeverityCVSS
CVE-2025-53770 Exploited
Microsoft SharePoint Server Remote Code Execution Vulnerability
 Critical 9.8
CVE-2025-53771
Microsoft SharePoint Server Spoofing Vulnerability
 Important 6.5

Updated components

0 files changed since the previous update for the same versions.

Sources

Updated
Cited passages from Microsoft's official notes (10)
  1. 1. - SharePoint Framework (SPFx) support.microsoft.com
  2. 2. - Administrative Actions Logging support.microsoft.com
  3. 3. - MinRole enhancements support.microsoft.com
  4. 4. - SharePoint Custom Tiles support.microsoft.com
  5. 5. - Hybrid Taxonomy support.microsoft.com
  6. 6. - OneDrive API for SharePoint on-premises support.microsoft.com
  7. 7. The OneDrive for Business modern user experience requires an active Software Assurance contract at the time that the experience is enabled, either by installation of the public update or by manual enablement. support.microsoft.com
  8. 8. This security update resolves a Microsoft SharePoint Server remote code execution vulnerability and Microsoft SharePoint Server spoofing vulnerability. support.microsoft.com
  9. 9. Users may experience an issue when loading some SharePoint page resources, and the following error message is logged in the SharePoint Unified Logging System (ULS) logs: support.microsoft.com
  10. 10. $farm.RemoveGenericAllowedListValue("SignOutRefererAllowList", "<resource path>") support.microsoft.com
Checked automatically: 7 of 8 checks passed, 10 quoted passages · compared with Microsoft's page on Nov 8, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: not passed

A second AI read the text against the sources: correctness 5/5, clarity 4/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake