Skip to the content
The Update Bureau
SharePoint Server 2016 SharePoint Server 2016 Security update
Patch Tuesday

KB5002805

KB5002805: Cumulative update for SharePoint Server, version 2016, November 2025. Remote code execution flaw fixed; farm-host access issue remains

In short

The update addresses a SharePoint remote code execution vulnerability and removes permissions that caused failures during later update installations. An open issue can log event tags when users access a settings page through an additional farm host.

Does it affect you? Applies to: Farms running the release version of SharePoint Server 2016.

Build
16.0.5526.1001
Security
1 fixed
Restart
Required

What changes

New features 7 changes

SharePoint Framework (SPFx)

For: SharePoint Server 2016 farms

  • SharePoint Server 2016 includes SharePoint Framework (SPFx).1
    Delivered as part of Feature Pack 2.

Administrative Actions Logging

For: SharePoint Server 2016 farms

  • The update includes Administrative Actions Logging.2

MinRole enhancements

For: SharePoint Server 2016 farms

  • The update includes MinRole enhancements.3

SharePoint Custom Tiles

For: SharePoint Server 2016 farms

  • The update includes SharePoint Custom Tiles.4

Hybrid Taxonomy

For: SharePoint Server 2016 farms

  • The update includes Hybrid Taxonomy.5

OneDrive API for SharePoint on-premises

For: SharePoint Server 2016 farms

  • The update includes the OneDrive API for SharePoint on-premises.6

OneDrive for Business modern user experience

  • The update includes the OneDrive for Business modern user experience for Software Assurance customers.7
    An active Software Assurance contract is required when the experience is enabled.

Fix 1 change

SharePoint Remote Code Execution Vulnerability

For: SharePoint Server 2016 farms

  • A SharePoint remote code execution vulnerability is addressed.8
    Addresses CVE-2025-62204.

Removal 1 change

WSS _WPG and IIS _IURS permissions

For: SharePoint Server 2016 administrators

  • The denied Write permission is removed for the WSS _WPG and IIS _IURS groups, resolving failures during newer update installations.9

Known issues

  1. Open Affects: Organizations and IT administrators

    Users may see “4gab5" event tags logged in the SharePoint Unified Logging System (ULS) logs when they access sitedirectorysettings.aspx by using ‘set other host’.

    Users might see “4gab5” event tags in SharePoint Unified Logging System (ULS) logs when they access sitedirectorysettings.aspx using ‘set other host’.10

    How to apply the workaround SharePoint Management Shell

    Adding the additional farm host allows it to access the page, which is otherwise restricted to the current farm host.10

    Step-by-step instructions, command & download kit
    3 steps SharePoint Management Shell Instructions (.txt)
    Show steps & kit Hide steps & kit
    Step-by-step procedure
    1. Confirm that the additional host is safe before adding it.
    2. In the SharePoint Management Shell, add the host to AdditionalValidSPFarmHosts and update the farm.
    3. Run iisreset.
    SharePoint Management Shell 
    > add-pssnapin *> $f = get-spfarm> $f.AddGenericAllowedListValue("AdditionalValidSPFarmHosts", "your_additional_farm_host")> $f.update()> iisreset

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2025-11-11
Classification
Security Updates
Type
Cumulative update
Restart
Required
Replaces
KB5002788, KB5002778, KB5002771, KB5002760, KB5002744
Replaced by
KB5002821
VersionBuildChannel
2016 16.0.5526.1001 General availability

Security

1 vulnerability fixed
1 important
VulnerabilitySeverityCVSS
CVE-2025-62204
Microsoft SharePoint Remote Code Execution Vulnerability
 Important 8.0

Downloads (Microsoft Update Catalog)

Package 2016
787.4 MB
sts-x-none.cab Main update · KB5002805 SHA-1: 47e5e9ae…c5baf7

Updated components

238 files changed since the previous update for the same versions.

Top changed componentsFiles
Client object model7
Document conversion3
Managed metadata3
Search2
Access Services1
PowerPoint1
Project Server1

Sources

Updated
Cited passages from Microsoft's official notes (10)
  1. 1. SharePoint Framework (SPFx) support.microsoft.com
  2. 2. Administrative Actions Logging support.microsoft.com
  3. 3. MinRole enhancements support.microsoft.com
  4. 4. SharePoint Custom Tiles support.microsoft.com
  5. 5. Hybrid Taxonomy support.microsoft.com
  6. 6. OneDrive API for SharePoint on-premises support.microsoft.com
  7. 7. OneDrive for Business modern user experience (available to Software Assurance customers) support.microsoft.com
  8. 8. This security update resolves Microsoft SharePoint Remote Code Execution Vulnerability. support.microsoft.com
  9. 9. Removes the denied Write permission for the WSS _WPG and IIS _IURS groups to resolve failures that occur during newer update installations. support.microsoft.com
  10. 10. Users may see “4gab5" event tags logged in the SharePoint Unified Logging System (ULS) logs when they access sitedirectorysettings.aspx using ‘set other host’. support.microsoft.com
Checked automatically: 8 of 8 checks passed, 10 quoted passages · compared with Microsoft's page on Oct 20, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: passed

A second AI read the text against the sources: correctness 5/5, clarity 5/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake