The Update BureauKB5002786: Cumulative update for SharePoint Server, version SE, October 2025. Closes two remote-code flaws and adds the 25H2 feature update
In short
The update closes two Important SharePoint remote code execution vulnerabilities and adds the 25H2 feature update. Farms using 2013-type workflows need the August 2025 Workflow Manager update first.
Does it affect you? Applies to: Farms running the release version of SharePoint Server Subscription Edition.
What changes
Fixes 4 changes
Business Data Connectivity (BDC)
For: SharePoint farm administrators
- BDC external lists hosted in an Oracle database no longer have the compatibility issue addressed by this update.1
Hybrid search
For: SharePoint farm administrators
- You can configure the search service account without giving it Local Administrator privileges.2
Navigation
- The TAB key can move between web part sections again.3
Search Query Logging timer job
For: SharePoint farm administrators
- The Search Query Logging timer job releases its SQL connections to the Search LinksStore database.4
Improvements 4 changes
LAYOUTS folder permissions
For: SharePoint farm administrators
- Write permission is denied by default for the WSS_WPG and IIS_IUSRS groups on the LAYOUTS folder, to help resolve update installation issues.5
Classic Workflow Manager
For: SharePoint farm administrators
-
If workflow functionality breaks, you can restore operations by enabling the debug flag and updating the farm.6
Run
$farm = Get-SPFarm,$farm.ServerDebugFlags.Add(53601),$farm.update(), andiisresetin the SharePoint Management Shell.
SharePoint Workflow Manager
For: SharePoint farm administrators
- The assemblies required by Microsoft.Data.SqlClient are now included.7
Unattached content database
For: SharePoint farm administrators
- Encryption settings are added to handle an unattached content database.8
New feature 1 change
SharePoint Server Subscription Edition Version 25H2
For: SharePoint farm administrators
- The 25H2 feature update is included, and future public updates will include it too.9
Technical details
Data sheet · Security · Downloads · Components Click to collapse or expand
Data sheet
- Released
- 2025-10-14
- Classification
- Security Updates
- Type
- Cumulative update
- Restart
- Required
- Replaces
- KB5002784, KB5002773, KB5002768, KB5002751
- Replaced by
- KB5002800
| Version | Build | Channel |
|---|---|---|
| SE | 16.0.19127.20262 | General availability |
Security
| Vulnerability | Severity | CVSS |
|---|---|---|
|
Microsoft SharePoint Remote Code Execution Vulnerability
|
Important | 8.8 |
|
Microsoft SharePoint Remote Code Execution Vulnerability
|
Important | 8.8 |
Downloads (Microsoft Update Catalog)
Package
SE
1.6 GB
sts-x-none.cab
Language packs (49)
- Arabic (Saudi Arabia)
- Azerbaijani (Latin, Azerbaijan)
- Basque (Spain)
- Bosnian (Latin, Bosnia & Herzegovina)
- Bulgarian (Bulgaria)
- Catalan (Spain)
- Chinese (China)
- Chinese (Taiwan)
- Croatian (Croatia)
- Czech (Czechia)
- Danish (Denmark)
- Dutch (Netherlands)
- English (United States)
- Estonian (Estonia)
- Finnish (Finland)
- French (France)
- Galician (Spain)
- German (Germany)
- Greek (Greece)
- Hebrew (Israel)
- Hindi (India)
- Hungarian (Hungary)
- Indonesian (Indonesia)
- Irish (Ireland)
- Italian (Italy)
- Japanese (Japan)
- Kazakh (Kazakhstan)
- Korean (South Korea)
- Latvian (Latvia)
- Lithuanian (Lithuania)
- Macedonian (North Macedonia)
- Malay (Malaysia)
- Norwegian Bokmål (Norway)
- Polish (Poland)
- Portuguese (Brazil)
- Portuguese (Portugal)
- Romanian (Romania)
- Russian (Russia)
- Serbian (Cyrillic, Serbia)
- Serbian (Latin, Serbia)
- Slovak (Slovakia)
- Slovenian (Slovenia)
- Spanish (Spain)
- Swedish (Sweden)
- Thai (Thailand)
- Turkish (Türkiye)
- Ukrainian (Ukraine)
- Vietnamese (Vietnam)
- Welsh (United Kingdom)
Sources
Cited passages from Microsoft's official notes (9)
-
1.
Fixes a compatibility issue that occurs if the Business Data Connectivity (BDC) external list is hosted in an Oracle database.
support.microsoft.com -
2.
Fixes a hybrid search issue. You can now configure the search service account without needing the Local Administrator privilege.
support.microsoft.com -
3.
Fixes a navigation issue that prevents the TAB key from moving between web part sections.
support.microsoft.com -
4.
Fixes an issue in which the Search Query Logging timer job doesn't release the SQL connections to the Search LinksStore database.
support.microsoft.com -
5.
To resolve update installation issues, the Write permission is now denied by default for the WSS_WPG and IIS_IUSRS groups on the LAYOUTS folder.
support.microsoft.com -
6.
If you experience a break in workflow functionality within Classic Workflow Manager, you can restore operations by running the following commands in the SharePoint Management Shell:
support.microsoft.com -
7.
Adds missing assemblies that Microsoft.Data.SqlClient requires in SharePoint Workflow Manager.
support.microsoft.com -
8.
Adds encryption settings to handle an unattached content database.
support.microsoft.com -
9.
This security update introduces the SharePoint Server Subscription Edition Version 25H2 feature update. This feature update will be included in all SharePoint Server Subscription Edition public updates going forward.
support.microsoft.com
Checked automatically: 8 of 8 checks passed, 9 quoted passages · compared with Microsoft's page on Oct 20, 2026
- Quotes found in the official pages: passed
- Numbers found in the sources: passed
- Vulnerabilities from the dossier only: passed
- Links to allowed domains only: passed
- Every official change covered: passed
- Readable plain text: passed
- Changes confirmed by the file list: passed
- Sources agree: passed
A second AI read the text against the sources: correctness 5/5, clarity 4/5, completeness 5/5. How we work
Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake