The Update BureauKB5002778
Cumulative update for SharePoint Server, version 2016, September 2025
Addresses three Important vulnerabilities. Updates for SharePoint Server 2016 end on July 14, 2026.
Does it affect you? Applies to: Devices running the x64 version of SharePoint Server 2016.
Microsoft ships this release as two packages: KB5002778, the update itself, and KB5002777 for the language packs. Install both on every server of the farm, then run the SharePoint Products Configuration Wizard.
In detail
- Security Addresses three Important vulnerabilities. None are listed as critical, publicly disclosed, or actively exploited.
- Lifecycle Updates for SharePoint Server 2016 end on July 14, 2026.
Technical details
Data sheet · Security · Downloads · Components Click to collapse or expand
Data sheet
- Released
- 2025-09-09
- Classification
- Security Updates
- Type
- Cumulative update
- Restart
- Required
- Replaces
- KB5002771, KB5002760, KB5002744
- Replaced by
- KB5002788
| Version | Build | Channel |
|---|---|---|
| 2016 | 16.0.5517.1000 | General availability |
Security
| Vulnerability | Severity | CVSS |
|---|---|---|
|
Microsoft SharePoint Remote Code Execution Vulnerability
|
Important | 8.8 |
|
Microsoft Office Remote Code Execution Vulnerability
|
Important | 7.8 |
|
Microsoft Word Information Disclosure Vulnerability
|
Important | 7.1 |
Downloads (Microsoft Update Catalog)
Language packs (51)
- Arabic (Saudi Arabia)
- Azerbaijani (Latin, Azerbaijan)
- Basque (Spain)
- Bosnian (Latin, Bosnia & Herzegovina)
- Bulgarian (Bulgaria)
- Catalan (Spain)
- Chinese (China)
- Chinese (Taiwan)
- Croatian (Croatia)
- Czech (Czechia)
- Danish (Denmark)
- Dari (Afghanistan)
- Dutch (Netherlands)
- English (United States)
- Estonian (Estonia)
- Finnish (Finland)
- French (France)
- Galician (Spain)
- German (Germany)
- Greek (Greece)
- Hebrew (Israel)
- Hindi (India)
- Hungarian (Hungary)
- Indonesian (Indonesia)
- Irish (Ireland)
- Italian (Italy)
- Japanese (Japan)
- Kazakh (Kazakhstan)
- Korean (South Korea)
- Latvian (Latvia)
- Lithuanian (Lithuania)
- Macedonian (North Macedonia)
- Malay (Malaysia)
- Norwegian Bokmål (Norway)
- Polish (Poland)
- Portuguese (Brazil)
- Portuguese (Portugal)
- Romanian (Romania)
- Russian (Russia)
- Serbian (Cyrillic, Serbia)
- Serbian (Latin, Serbia)
- Serbian (Latin, Serbia)
- Slovak (Slovakia)
- Slovenian (Slovenia)
- Spanish (Spain)
- Swedish (Sweden)
- Thai (Thailand)
- Turkish (Türkiye)
- Ukrainian (Ukraine)
- Vietnamese (Vietnam)
- Welsh (United Kingdom)
Updated components
230 files changed since the previous update for the same versions.
| Top changed components | Files |
|---|---|
| Client object model | 7 |
| Project Server | 4 |
| Document conversion | 2 |
| Access Services | 1 |
| PowerPoint | 1 |
| PowerShell | 1 |
Sources
Checked automatically: 8 of 8 checks passed · compared with Microsoft's page on Nov 8, 2026
- Quotes found in the official pages: passed
- Numbers found in the sources: passed
- Vulnerabilities from the dossier only: passed
- Links to allowed domains only: passed
- Every official change covered: passed
- Readable plain text: passed
- Changes confirmed by the file list: passed
- Sources agree: passed
A second AI read the text against the sources: correctness 5/5, clarity 5/5, completeness 5/5. How we work
Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake