KB5002784: Cumulative update for SharePoint Server, version SE, September 2025. Remote code execution flaw resolved; 25H2 feature update arrives

A SharePoint remote code execution vulnerability, CVE-2025-54897, is resolved. The update also introduces the 25H2 feature update and changes workflow requirements, AMSI defaults, and machine-key rotation.

Does it affect you? Applies to: SharePoint Server Subscription Edition servers with the release version installed. The update package is for x64.

What changes

Improvements 5 changes

Workflows

SharePoint workflows now require the latest SharePoint Workflow Manager update.¹

WSS_WPG group

The WSS_WPG group is restricted from running administrative processes, including the SharePoint Products Configuration Wizard.²
The restriction applies to administrative processes such as the SharePoint Products Configuration Wizard (Psconfig).

Machine Key Rotation Job

Machine key rotation runs weekly instead of monthly and starts automatically after each update cycle finishes.³

AMSI Filter

The AMSI Filter feature module is on by default.⁴
The default setting for the AMSI Filter feature module changes to always on.

Microsoft.Exchange.OfficeGraph.SpoolsScaleOutMapper

The Microsoft.Exchange.OfficeGraph.SpoolsScaleOutMapper package is updated.⁵
Updates Microsoft.Exchange.OfficeGraph.SpoolsScaleOutMapper to version 5.0.5.

Fixes 2 changes

Throttling rules

Requests that match throttling rules are no longer all blocked immediately.⁶
Fixes the issue in which all matching requests were immediately blocked when throttling rules were configured.

Outgoing email

Some characters in outgoing email using the GB18030 character set display correctly.⁷
Fixes incorrect display of some characters in email messages when GB18030 is used for outgoing email.

New features 2 changes

SharePoint Server Subscription Edition

The SharePoint Server Subscription Edition 25H2 feature update is included.⁸
This feature update will be included in all future SharePoint Server Subscription Edition public updates.

SharePoint Management Shell

You can use a new cmdlet to check that Windows Defender components are installed and active and that SharePoint antimalware scanning is working.⁹
The Test-DefenderAndAmsiWorkProperly cmdlet verifies Windows Defender components and SharePoint AMSI integration.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released: 2025-09-09
Classification: Security Updates
Type: Cumulative update
Restart: Required
Replaces: KB5002773, KB5002768, KB5002751, KB5002736

+14 earlier
KB5002709, KB5002705, KB5002681, KB5002676, KB5002658, KB5002651, KB5002649, KB5002640, KB5002606, KB5002603, KB5002599, KB5002581, KB5002564, KB5002540
Replaced by: KB5002786

Version	Build	Channel
SE	16.0.19127.20100	General availability

Security

1 vulnerability fixed

1 important

Vulnerability	Severity	CVSS
CVE-2025-54897 Microsoft SharePoint Remote Code Execution Vulnerability	Important	8.8

Downloads (Microsoft Update Catalog)

Package SE

1.6 GB

sts-x-none.cab Main update · KB5002784 SHA-1: d5065c92…c427ee

Language packs (49)

Updated components

0 files changed since the previous update for the same versions.

Sources

Updated Oct 27, 2026

Cited passages from Microsoft's official notes (9)

1. In order to use workflows in SharePoint Server, you must now have the latest update for SharePoint Workflow Manager installed. support.microsoft.com
2. To strengthen security in SharePoint Server, users in the WSS_WPG group are now restricted from running administrative processes, such as the SharePoint Products Configuration Wizard (Psconfig). support.microsoft.com
3. Updates the Machine Key Rotation Job schedule from monthly to weekly and make sure that it's automatically triggered after each update cycle finishes. support.microsoft.com
4. Enhances the AMSI Filter feature module. Changes the default setting to be always on. support.microsoft.com
5. Updates the NuGet package Microsoft.Exchange.OfficeGraph.SpoolsScaleOutMapper to version 5.0.5. support.microsoft.com
6. Fixes an issue in which all matching requests are immediately blocked when throttling rules are configured. support.microsoft.com
7. Fixes an issue in which some characters cannot be displayed correctly in email messages if they use the GB18030 character set for outgoing email. support.microsoft.com
8. This security update introduces the SharePoint Server Subscription Edition Version 25H2 feature update. support.microsoft.com
9. You can now use the Test-DefenderAndAmsiWorkProperly cmdlet in SharePoint Management Shell to verify that all Windows Defender components are installed and active support.microsoft.com

Checked automatically: 8 of 8 checks passed, 9 quoted passages · compared with Microsoft's page on Oct 20, 2026

Quotes found in the official pages: passed
Numbers found in the sources: passed
Vulnerabilities from the dossier only: passed
Links to allowed domains only: passed
Every official change covered: passed
Readable plain text: passed
Changes confirmed by the file list: passed
Sources agree: passed

A second AI read the text against the sources: correctness 5/5, clarity 4/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake