Skip to the content
The Update Bureau
SharePoint Server 2016 SharePoint Server 2016 Security update
Patch Tuesday

KB5002771

KB5002771: Cumulative update for SharePoint Server, version 2016, August 2025. Critical Word flaw patched; BCS support needs manual enabling

In short

A critical Word flaw that could allow remote code execution is patched. BCS support for two system types still needs manual enabling, and calendar overlay settings might have an issue.

Does it affect you? Applies to: SharePoint Server 2016 farms with the release version installed. The x64 update sets build 16.0.5513.1002.

Build
16.0.5513.1002
Security
4 fixed · 1 critical
Restart
Required

Microsoft ships this release as two packages: KB5002771, the update itself, and KB5002772 for the language packs. Install both on every server of the farm, then run the SharePoint Products Configuration Wizard.

What changes

New features 7 changes

SharePoint Framework (SPFx)

  • SharePoint Framework is included.1
    Delivered in Feature Pack 2.

Administrative Actions Logging

  • Administrative Actions Logging is included.2
    Delivered as a Feature Pack 1 feature.

MinRole enhancements

  • MinRole enhancements are included.2
    Delivered as a Feature Pack 1 feature.

SharePoint Custom Tiles

  • SharePoint Custom Tiles are included.2
    Delivered as a Feature Pack 1 feature.

Hybrid Taxonomy

  • Hybrid Taxonomy is included.2
    Delivered as a Feature Pack 1 feature.

OneDrive API for SharePoint on-premises

  • The OneDrive API for SharePoint on-premises is included.2
    Delivered as a Feature Pack 1 feature.

OneDrive for Business modern user experience

  • The modern OneDrive for Business experience is available to Software Assurance customers.3
    An active Software Assurance contract is required when the experience is enabled, either by installing the public update or by enabling it manually. Without an active contract at enablement, turn off the experience.

Fix 1 change

Business Connectivity Services

  • Business Connectivity Services support for two system types can be enabled for trusted models by running commands.4
    The DotNetAssembly and WebService system types are not enabled by default. If you trust your BDC models, run these commands in SharePoint Management Shell: $farm = Get-SPFarm; $farm.ServerDebugFlags.Add(57007); $farm.ServerDebugFlags.Add(57008); $farm.update(); iisreset.

Improvement 1 change

Cloud Search Service Application

  • A warning appears before deleting a Cloud Search Service Application if users have not verified that hybrid indexes are removed.5

Known issues

  1. Open Affects: Organizations and IT administrators

    After you install this update, you might experience an issue when you configure calendar overlay settings.

    You might experience an issue when configuring calendar overlay settings after installing this update.6

    Workaround status No workaround yet

    Microsoft has not published a manual workaround for this issue yet. Monitor release health until a resolving update is available.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2025-08-12
Classification
Security Updates
Type
Cumulative update
Restart
Required
Replaces
KB5002760, KB5002744
Replaced by
KB5002778
VersionBuildChannel
2016 16.0.5513.1002 General availability

Security

4 vulnerabilities fixed
1 critical 3 important
VulnerabilitySeverityCVSS
CVE-2025-53733
Microsoft Word Remote Code Execution Vulnerability
 Critical 8.4
CVE-2025-49712
Microsoft SharePoint Remote Code Execution Vulnerability
 Important 8.8
CVE-2025-53760
Microsoft SharePoint Elevation of Privilege Vulnerability
 Important 7.1
CVE-2025-53736
Microsoft Word Information Disclosure Vulnerability
 Important 6.8

Updated components

0 files changed since the previous update for the same versions.

Sources

Updated
Cited passages from Microsoft's official notes (6)
  1. 1. This public update delivers Feature Pack 2 for SharePoint Server 2016. Feature Pack 2 contains the following feature: - SharePoint Framework (SPFx) support.microsoft.com
  2. 2. Administrative Actions Logging - MinRole enhancements - SharePoint Custom Tiles - Hybrid Taxonomy - OneDrive API for SharePoint on-premises support.microsoft.com
  3. 3. The OneDrive for Business modern user experience requires an active Software Assurance contract at the time that the experience is enabled, either by installation of the public update or by manual enablement. support.microsoft.com
  4. 4. To support Business Data Connectivity (BDC) models that are based on the DotNetAssembly or WebService system type, enable the support by running the following commands in SharePoint Management Shell if you trust your BDC models: support.microsoft.com
  5. 5. Adds a warning when deleting a Cloud Search Service Application (Cloud SSA) if users have not verified that the hybrid indexes are removed. support.microsoft.com
  6. 6. After you install this update, you might experience an issue when you configure calendar overlay settings. support.microsoft.com
Checked automatically: 7 of 8 checks passed, 6 quoted passages · compared with Microsoft's page on Nov 8, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: not passed

A second AI read the text against the sources: correctness 4/5, clarity 4/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake