Skip to the content
The Update Bureau
SharePoint Server 2019 SharePoint Server 2019 Security update
Patch Tuesday

KB5002803

KB5002803: Cumulative update for SharePoint Server, version 2019, November 2025. Remote code execution flaw closed; China certificate issue fixed

In short

Closes an Important SharePoint remote code execution vulnerability, CVE-2025-62204, and fixes a China certificate issue. A known issue can log event tags when users access a farm settings page using ‘set other host’.

Does it affect you? Applies to: Computers running the release version of SharePoint Server 2019. The update package is for x64.

Build
16.0.10417.20068
Security
1 fixed
Restart
Required

What changes

Fixes 2 changes

SharePoint Server

2 items

For: SharePoint Server 2019 farm administrators

  • A Microsoft SharePoint remote code execution vulnerability is fixed.1
    Resolves CVE-2025-62204.
  • The GB18030-2022 China certificate issue is fixed.2

Improvement 1 change

Audit logs

For: Users configuring audit logs

  • Users must choose the library for storing audit logs before they can proceed.3

Known issues

  1. Open Affects: Organizations and IT administrators

    Users may see “4gab5" event tags logged in the SharePoint Unified Logging System (ULS) logs when they access sitedirectorysettings.aspx by using ‘set other host’.

    Accessing sitedirectorysettings.aspx using ‘set other host’ might log “4gab5” event tags in SharePoint Unified Logging System (ULS) logs. Enhanced security restricts access to the page to the current farm host.4

    How to apply the workaround PowerShell

    The setting allows the additional farm host, addressing the restriction that otherwise limits access to the current farm host.4

    Step-by-step instructions, command & download kit
    2 steps SharePoint Management Shell Instructions (.txt)
    Show steps & kit Hide steps & kit
    Step-by-step procedure
    1. Make sure the setting host is safe before adding the new domain.
    2. Run the commands in SharePoint Management Shell.
    SharePoint Management Shell 
    > add-pssnapin *> $f = get-spfarm> $f.AddGenericAllowedListValue("AdditionalValidSPFarmHosts", "your_additional_farm_host")> $f.update()> iisreset

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2025-11-11
Classification
Security Updates
Type
Cumulative update
Restart
Required
Replaces
KB5002796, KB5002775, KB5002769, KB5002754, KB5002741
Replaced by
KB5002816
VersionBuildChannel
2019 16.0.10417.20068 General availability

Security

1 vulnerability fixed
1 important
VulnerabilitySeverityCVSS
CVE-2025-62204
Microsoft SharePoint Remote Code Execution Vulnerability
 Important 8.0

Downloads (Microsoft Update Catalog)

Package 2019
445.4 MB
sts-x-none.cab Main update · KB5002803 SHA-1: 90e58b6e…767410

Updated components

453 files changed since the previous update for the same versions.

Top changed componentsFiles
Search44
Project Server23
Document conversion20
Client object model9
Access Services8
Document management and policies6
Managed metadata3
Office web apps3
PowerPoint3
PowerShell2
Publishing2
Translation Services2

Sources

Updated
Cited passages from Microsoft's official notes (4)
  1. 1. This security update resolves a Microsoft SharePoint Remote Code Execution vulnerability. support.microsoft.com
  2. 2. This update fixes the GB18030-2022 China certificate issue. support.microsoft.com
  3. 3. This update requires users to specify the library for storing the audit logs before they proceed. support.microsoft.com
  4. 4. Users may see “4gab5" event tags logged in the SharePoint Unified Logging System (ULS) logs when they access sitedirectorysettings.aspx by using ‘set other host’. support.microsoft.com
Checked automatically: 8 of 8 checks passed, 4 quoted passages · compared with Microsoft's page on Oct 20, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: passed

A second AI read the text against the sources: correctness 5/5, clarity 4/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake