The Update BureauKB5002769: Cumulative update for SharePoint Server, version 2019, August 2025. Critical Word remote-code flaw addressed; calendar setup issue remains
A critical Word remote-code flaw is addressed, and support can be enabled for two Business Connectivity Services system types. Calendar overlay settings may have an issue during configuration.
Does it affect you? Applies to: SharePoint Server 2019 installations running the release version. This update applies to the x64 edition.
Microsoft ships this release as two packages: KB5002769, the update itself, and KB5002770 for the language packs. Install both on every server of the farm, then run the SharePoint Products Configuration Wizard.
What changes
Fix 1 change
Business Connectivity Services
-
Business Connectivity Services can use two system types after support is enabled for trusted models.1
To support Business Data Connectivity models based on
DotNetAssemblyorWebService, run these commands in SharePoint Management Shell if you trust your models:$farm = Get-SPFarm;$farm.ServerDebugFlags.Add(57007);$farm.ServerDebugFlags.Add(57008);$farm.update();iisreset. Install KB5002770 with this update to get the fix completely.
Improvement 1 change
Cloud Search Service Application
- A warning appears before deleting a Cloud Search Service Application if users have not confirmed that hybrid indexes are removed.2
Known issues
-
After you install this update, you might experience an issue when you configure calendar overlay settings.
After installing this update, you may experience an issue when configuring calendar overlay settings.3
Workaround status No workaround yetMicrosoft has not published a manual workaround for this issue yet. Monitor release health until a resolving update is available.
Technical details
Data sheet · Security · Downloads · Components Click to collapse or expand
Data sheet
- Released
- 2025-08-12
- Classification
- Security Updates
- Type
- Cumulative update
- Restart
- Required
- Replaces
- KB5002754, KB5002741
- Replaced by
- KB5002775
| Version | Build | Channel |
|---|---|---|
| 2019 | 16.0.10417.20041 | General availability |
Security
| Vulnerability | Severity | CVSS |
|---|---|---|
|
Microsoft Word Remote Code Execution Vulnerability
|
Critical | 8.4 |
|
Microsoft SharePoint Remote Code Execution Vulnerability
|
Important | 8.8 |
|
Microsoft SharePoint Elevation of Privilege Vulnerability
|
Important | 7.1 |
|
Microsoft Word Information Disclosure Vulnerability
|
Important | 6.8 |
Downloads (Microsoft Update Catalog)
Language packs (50)
- Arabic (Saudi Arabia)
- Azerbaijani (Latin, Azerbaijan)
- Basque (Spain)
- Bosnian (Latin, Bosnia & Herzegovina)
- Bulgarian (Bulgaria)
- Catalan (Spain)
- Chinese (China)
- Chinese (Taiwan)
- Croatian (Croatia)
- Czech (Czechia)
- Danish (Denmark)
- Dari (Afghanistan)
- Dutch (Netherlands)
- English (United States)
- Estonian (Estonia)
- Finnish (Finland)
- French (France)
- Galician (Spain)
- German (Germany)
- Greek (Greece)
- Hebrew (Israel)
- Hindi (India)
- Hungarian (Hungary)
- Indonesian (Indonesia)
- Irish (Ireland)
- Italian (Italy)
- Japanese (Japan)
- Kazakh (Kazakhstan)
- Korean (South Korea)
- Latvian (Latvia)
- Lithuanian (Lithuania)
- Macedonian (North Macedonia)
- Malay (Malaysia)
- Norwegian Bokmål (Norway)
- Polish (Poland)
- Portuguese (Brazil)
- Portuguese (Portugal)
- Romanian (Romania)
- Russian (Russia)
- Serbian (Cyrillic, Serbia)
- Serbian (Latin, Serbia)
- Slovak (Slovakia)
- Slovenian (Slovenia)
- Spanish (Spain)
- Swedish (Sweden)
- Thai (Thailand)
- Turkish (Türkiye)
- Ukrainian (Ukraine)
- Vietnamese (Vietnam)
- Welsh (United Kingdom)
Updated components
424 files changed since the previous update for the same versions.
| Top changed components | Files |
|---|---|
| Search | 44 |
| Project Server | 23 |
| Document conversion | 20 |
| Client object model | 9 |
| Access Services | 8 |
| Document management and policies | 6 |
| Managed metadata | 3 |
| Office web apps | 3 |
| PowerPoint | 3 |
| PowerShell | 2 |
| Publishing | 2 |
| Translation Services | 2 |
Verified in package: changed files confirm Cloud Search Service Application.
Sources
Cited passages from Microsoft's official notes (3)
-
1.
Fixes an issue in which users cannot use Business Connectivity Services (BCS) together with the
support.microsoft.comDotNetAssemblyorWebServicesystem type, because these system types are not enabled by default. -
2.
Adds a warning when deleting a Cloud Search Service Application (Cloud SSA) if users have not verified that the hybrid indexes are removed.
support.microsoft.com -
3.
After you install this update, you may experience an issue when you configure calendar overlay settings.
support.microsoft.com
Checked automatically: 7 of 8 checks passed, 3 quoted passages · compared with Microsoft's page on Nov 8, 2026
- Quotes found in the official pages: passed
- Numbers found in the sources: passed
- Vulnerabilities from the dossier only: passed
- Links to allowed domains only: passed
- Every official change covered: passed
- Readable plain text: passed
- Changes confirmed by the file list: passed
- Sources agree: not passed
A second AI read the text against the sources: correctness 5/5, clarity 4/5, completeness 5/5. How we work
Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake