The Update BureauKB5002796: Cumulative update for SharePoint Server, version 2019, October 2025. Six vulnerabilities covered ahead of July 2026 support end
In short
Covers six Important security vulnerabilities. SharePoint Server 2019 support ends July 14, 2026.
Does it affect you? Applies to: Devices running SharePoint Server 2019, all editions.
Microsoft ships this release as two packages: KB5002796, the update itself, and KB5002798 for the language packs. Install both on every server of the farm, then run the SharePoint Products Configuration Wizard.
In detail
- Security Covers six vulnerabilities, all rated Important. No exploited, publicly disclosed, or Critical vulnerabilities are listed.
- Lifecycle Support for SharePoint Server 2019 ends July 14, 2026, for all editions.
Technical details
Data sheet · Security · Downloads · Components Click to collapse or expand
Data sheet
- Released
- 2025-10-14
- Classification
- Security Updates
- Type
- Cumulative update
- Restart
- Required
- Replaces
- KB5002775, KB5002769, KB5002754, KB5002741
- Replaced by
- KB5002803
| Version | Build | Channel |
|---|---|---|
| 2019 | 16.0.10417.20059 | General availability |
Security
| Vulnerability | Severity | CVSS |
|---|---|---|
|
Microsoft SharePoint Remote Code Execution Vulnerability
|
Important | 8.8 |
|
Microsoft SharePoint Remote Code Execution Vulnerability
|
Important | 8.8 |
|
Microsoft Word Remote Code Execution Vulnerability
|
Important | 7.8 |
|
Microsoft Excel Information Disclosure Vulnerability
|
Important | 7.1 |
|
Microsoft Excel Information Disclosure Vulnerability
|
Important | 7.1 |
|
Microsoft Word Remote Code Execution Vulnerability
|
Important | 7.0 |
Downloads (Microsoft Update Catalog)
Package
2019
445.4 MB
Package
2019
0.9 GB
Language packs (50)
- Arabic (Saudi Arabia)
- Azerbaijani (Latin, Azerbaijan)
- Basque (Spain)
- Bosnian (Latin, Bosnia & Herzegovina)
- Bulgarian (Bulgaria)
- Catalan (Spain)
- Chinese (China)
- Chinese (Taiwan)
- Croatian (Croatia)
- Czech (Czechia)
- Danish (Denmark)
- Dari (Afghanistan)
- Dutch (Netherlands)
- English (United States)
- Estonian (Estonia)
- Finnish (Finland)
- French (France)
- Galician (Spain)
- German (Germany)
- Greek (Greece)
- Hebrew (Israel)
- Hindi (India)
- Hungarian (Hungary)
- Indonesian (Indonesia)
- Irish (Ireland)
- Italian (Italy)
- Japanese (Japan)
- Kazakh (Kazakhstan)
- Korean (South Korea)
- Latvian (Latvia)
- Lithuanian (Lithuania)
- Macedonian (North Macedonia)
- Malay (Malaysia)
- Norwegian Bokmål (Norway)
- Polish (Poland)
- Portuguese (Brazil)
- Portuguese (Portugal)
- Romanian (Romania)
- Russian (Russia)
- Serbian (Cyrillic, Serbia)
- Serbian (Latin, Serbia)
- Slovak (Slovakia)
- Slovenian (Slovenia)
- Spanish (Spain)
- Swedish (Sweden)
- Thai (Thailand)
- Turkish (Türkiye)
- Ukrainian (Ukraine)
- Vietnamese (Vietnam)
- Welsh (United Kingdom)
Sources
Updated
Checked automatically: 8 of 8 checks passed · compared with Microsoft's page on Nov 8, 2026
- Quotes found in the official pages: passed
- Numbers found in the sources: passed
- Vulnerabilities from the dossier only: passed
- Links to allowed domains only: passed
- Every official change covered: passed
- Readable plain text: passed
- Changes confirmed by the file list: passed
- Sources agree: passed
A second AI read the text against the sources: correctness 5/5, clarity 5/5, completeness 5/5. How we work
Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake