Skip to the content
The Update Bureau
SharePoint Server SE SharePoint Server SE Security update
Patch Tuesday

KB5002800

KB5002800: Cumulative update for SharePoint Server, version SE, November 2025. Remote code execution flaw closed; 25H2 features arrive

In short

Closes a SharePoint remote code execution vulnerability and introduces the 25H2 feature update, which will be included in future public updates.

Does it affect you? Applies to: SharePoint Server Subscription Edition devices with the release version installed. The update package is for x64.

Build
16.0.19127.20338
Security
1 fixed
Restart
Required

What changes

Fixes 3 changes

SharePoint Server

  • Closes a remote code execution vulnerability in SharePoint Server.1
    Resolves CVE-2025-62204.

Certificates

  • The GB18030-2022 certificate issue is fixed.2

Role definitions

  • The “Edit” role definition created in SharePoint 2007 can be imported into the SharePoint Subscription Edition environment.3

New feature 1 change

SharePoint Server Subscription Edition Version 25H2

  • The Version 25H2 feature update is introduced and will be included in future public updates.4

Known issues

  1. Open Affects: Organizations and IT administrators

    Users may see “4gab5" event tags logged in the SharePoint Unified Logging System (ULS) logs when they access sitedirectorysettings.aspx by using ‘set other host’.

    Accessing sitedirectorysettings.aspx by using ‘set other host’ can log “4gab5” event tags in SharePoint Unified Logging System (ULS) logs. The issue occurs because enhanced security restricts access to the current farm host.5

    How to apply the workaround SharePoint Management Shell

    Adding the domain to AdditionalValidSPFarmHosts allows it as an additional farm host under this restriction.5

    Step-by-step instructions, command & download kit
    3 steps SharePoint Management Shell Instructions (.txt)
    Show steps & kit Hide steps & kit
    Step-by-step procedure
    1. Confirm that the additional host is safe.
    2. In SharePoint Management Shell, run the commands below, replacing your_additional_farm_host with the safe domain.
    3. Run iisreset to restart IIS.
    SharePoint Management Shell 
    > add-pssnapin *> $f = get-spfarm> $f.AddGenericAllowedListValue("AdditionalValidSPFarmHosts", "your_additional_farm_host")> $f.update()> iisreset

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2025-11-11
Classification
Security Updates
Type
Cumulative update
Restart
Required
Replaces
KB5002786, KB5002784, KB5002773, KB5002768
+16 earlier KB5002751, KB5002736, KB5002709, KB5002705, KB5002681, KB5002676, KB5002658, KB5002651, KB5002649, KB5002640, KB5002606, KB5002603, KB5002599, KB5002581, KB5002564, KB5002540
Replaced by
KB5002815
VersionBuildChannel
SE 16.0.19127.20338 General availability

Security

1 vulnerability fixed
1 important
VulnerabilitySeverityCVSS
CVE-2025-62204
Microsoft SharePoint Remote Code Execution Vulnerability
 Important 8.0

Updated components

0 files changed since the previous update for the same versions.

Sources

Updated
Cited passages from Microsoft's official notes (5)
  1. 1. This security update resolves a Microsoft SharePoint Remote Code Execution vulnerability. To learn more about the vulnerability, see Microsoft Common Vulnerabilities and Exposures CVE-2025-62204. support.microsoft.com
  2. 2. This update fixes the GB18030-2022 certificate issue. support.microsoft.com
  3. 3. This update fixes an issue in which the "Edit" role definition that's created in SharePoint 2007 doesn't import into the SharePoint Subscription Edition environment. support.microsoft.com
  4. 4. This security update introduces the SharePoint Server Subscription Edition Version 25H2 feature update. This feature update will be included in all SharePoint Server Subscription Edition public updates going forward. support.microsoft.com
  5. 5. Users may see “4gab5" event tags logged in the SharePoint Unified Logging System (ULS) logs when they access sitedirectorysettings.aspx by using ‘set other host’. support.microsoft.com
Checked automatically: 8 of 8 checks passed, 5 quoted passages · compared with Microsoft's page on Oct 20, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: passed

A second AI read the text against the sources: correctness 5/5, clarity 4/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake