Skip to the content
The Update Bureau
SharePoint Server SE SharePoint Server SE Out-of-band security update
Out-of-band Zero-day

KB5002768

KB5002768: Cumulative update for SharePoint Server, version SE, July 2025. Exploited remote-code flaw patched; page resources may fail to load

In short

Closes a critical SharePoint Server remote-code execution flaw that attackers are exploiting. Some SharePoint page resources might fail to load after installation.

Does it affect you? Applies to: Computers running the release version of SharePoint Server Subscription Edition.

Build
16.0.18526.20508
Security
2 fixed · 1 critical · 1 exploited
Restart
Required
Review notes Additional details from the official release notes (1) Read note
  • Known issues The update describes one issue: some SharePoint page resources may fail to load. The RemoveGenericAllowedListValue command removes a path from the AllowList; it is not a second issue or a workaround for the loading problem.

The official sources are linked at the end of the page.

What changes

Fixes 2 changes

SharePoint Server

2 items
  • Closes a remote code execution vulnerability in SharePoint Server.1
    Addresses CVE-2025-53770.
  • Closes a spoofing vulnerability in SharePoint Server.1
    Addresses CVE-2025-53771.

Known issues

  1. Open Affects: Organizations and IT administrators

    $farm.ContainsGenericAllowedListValue("SignOutRefererAllowList", "<resource path>")

    Some SharePoint page resources might fail to load, and the ULS logs might show an access-denied message for the resource path.2

    How to apply the workaround SharePoint Management Shell

    Adding the resource path to the AllowList works around the access-denied block when that resource is loaded.2

    Step-by-step instructions, command & download kit
    2 steps SharePoint Management Shell Instructions (.txt)
    Show steps & kit Hide steps & kit
    Step-by-step procedure
    1. Make sure the resource path is valid and as expected.
    2. In SharePoint Management Shell, check whether the path is already in the AllowList; if needed, add it, update the farm, and run iisreset.
    SharePoint Management Shell 
    > $farm = get-spfarm> $farm.ContainsGenericAllowedListValue("SignOutRefererAllowList", "<resource path>")> $farm.AddGenericAllowedListValue("SignOutRefererAllowList", "<resource path>")> $farm.Update()> iisreset
  2. Open Affects: Organizations and IT administrators

    $farm.RemoveGenericAllowedListValue("SignOutRefererAllowList", "<resource path>")

    Some SharePoint page resources might fail to load, and the ULS logs might show an access-denied message for the resource path.2

    How to apply the workaround SharePoint Management Shell

    Adding the resource path to the AllowList works around the access-denied block when that resource is loaded.2

    Step-by-step instructions, command & download kit
    2 steps SharePoint Management Shell Instructions (.txt)
    Show steps & kit Hide steps & kit
    Step-by-step procedure
    1. Make sure the resource path is valid and as expected.
    2. In SharePoint Management Shell, check whether the path is already in the AllowList; if needed, add it, update the farm, and run iisreset.
    SharePoint Management Shell 
    > $farm = get-spfarm> $farm.ContainsGenericAllowedListValue("SignOutRefererAllowList", "<resource path>")> $farm.AddGenericAllowedListValue("SignOutRefererAllowList", "<resource path>")> $farm.Update()> iisreset

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2025-07-21
Classification
Security Updates
Type
Cumulative update
Restart
Required
Replaces
KB5002751, KB5002736, KB5002709, KB5002705
+12 earlier KB5002681, KB5002676, KB5002658, KB5002651, KB5002649, KB5002640, KB5002606, KB5002603, KB5002599, KB5002581, KB5002564, KB5002540
Replaced by
KB5002773
VersionBuildChannel
SE 16.0.18526.20508 General availability

Security

2 vulnerabilities fixed
1 exploited 1 critical 1 important
VulnerabilitySeverityCVSS
CVE-2025-53770 Exploited
Microsoft SharePoint Server Remote Code Execution Vulnerability
 Critical 9.8
CVE-2025-53771
Microsoft SharePoint Server Spoofing Vulnerability
 Important 6.5

Updated components

0 files changed since the previous update for the same versions.

Sources

Updated
Cited passages from Microsoft's official notes (2)
  1. 1. This security update resolves a Microsoft SharePoint Server remote code execution vulnerability and Microsoft SharePoint Server spoofing vulnerability. support.microsoft.com
  2. 2. To work around this issue, farm administrators can add the resource path in the AllowList by running the following PowerShell commands: support.microsoft.com
Checked automatically: 7 of 8 checks passed, 2 quoted passages · compared with Microsoft's page on Oct 20, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: not passed

A second AI read the text against the sources: correctness 3/5, clarity 3/5, completeness 4/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake