The Update BureauKB5002821: Cumulative update for SharePoint Server, version 2016, December 2025. Outlook and Word code-execution flaws addressed; HTTP scanning enabled
In short
The update addresses remote code execution vulnerabilities affecting Outlook and Word, and enables scanning of HTTP request bodies in SharePoint 2016. SharePoint Server 2016 updates end July 14, 2026.
Does it affect you? Applies to: SharePoint Server 2016 devices with the release version installed. The package is for x64 systems.
Microsoft ships this release as two packages: KB5002821, the update itself, and KB5002804 for the language packs. Install both on every server of the farm, then run the SharePoint Products Configuration Wizard.
What changes
New features 7 changes
SharePoint Framework (SPFx)
For: SharePoint administrators and users
-
SharePoint Server 2016 receives the SharePoint Framework.1
Delivered as part of Feature Pack 2.
Administrative Actions Logging
-
SharePoint Server 2016 receives Administrative Actions Logging.2
Included among the features delivered from Feature Pack 1.
MinRole enhancements
-
SharePoint Server 2016 receives MinRole enhancements.3
Included among the features delivered from Feature Pack 1.
SharePoint Custom Tiles
For: SharePoint administrators and users
-
SharePoint Server 2016 receives SharePoint Custom Tiles.4
Included among the features delivered from Feature Pack 1.
Hybrid Taxonomy
-
SharePoint Server 2016 receives Hybrid Taxonomy.5
Included among the features delivered from Feature Pack 1.
OneDrive API for SharePoint on-premises
For: SharePoint administrators and users
-
SharePoint Server 2016 receives the OneDrive API for on-premises SharePoint.6
Included among the features delivered from Feature Pack 1.
OneDrive for Business modern user experience
For: SharePoint administrators and users
-
The OneDrive for Business modern user experience is available.7
Requires an active Software Assurance contract when enabled. If there is no active contract at enablement, the experience must be turned off.
Technical details
Data sheet · Security · Downloads · Components Click to collapse or expand
Data sheet
- Released
- 2025-12-09
- Classification
- Security Updates
- Type
- Cumulative update
- Restart
- Required
- Replaces
- KB5002805, KB5002788, KB5002778, KB5002771
- Replaced by
- KB5002828
| Version | Build | Channel |
|---|---|---|
| 2016 | 16.0.5530.1000 | General availability |
Security
| Vulnerability | Severity | CVSS |
|---|---|---|
|
Microsoft Word Remote Code Execution Vulnerability
|
Important | 7.8 |
|
Microsoft Word Remote Code Execution Vulnerability
|
Important | 7.8 |
|
Microsoft Outlook Remote Code Execution Vulnerability
|
Important | 7.8 |
|
Microsoft Word Remote Code Execution Vulnerability
|
Important | 7.0 |
Downloads (Microsoft Update Catalog)
Package
2016
559.8 MB
wss-x-none.cab
Language packs (51)
- Arabic (Saudi Arabia)
- Azerbaijani (Latin, Azerbaijan)
- Basque (Spain)
- Bosnian (Latin, Bosnia & Herzegovina)
- Bulgarian (Bulgaria)
- Catalan (Spain)
- Chinese (China)
- Chinese (Taiwan)
- Croatian (Croatia)
- Czech (Czechia)
- Danish (Denmark)
- Dari (Afghanistan)
- Dutch (Netherlands)
- English (United States)
- Estonian (Estonia)
- Finnish (Finland)
- French (France)
- Galician (Spain)
- German (Germany)
- Greek (Greece)
- Hebrew (Israel)
- Hindi (India)
- Hungarian (Hungary)
- Indonesian (Indonesia)
- Irish (Ireland)
- Italian (Italy)
- Japanese (Japan)
- Kazakh (Kazakhstan)
- Korean (South Korea)
- Latvian (Latvia)
- Lithuanian (Lithuania)
- Macedonian (North Macedonia)
- Malay (Malaysia)
- Norwegian Bokmål (Norway)
- Polish (Poland)
- Portuguese (Brazil)
- Portuguese (Portugal)
- Romanian (Romania)
- Russian (Russia)
- Serbian (Cyrillic, Serbia)
- Serbian (Latin, Serbia)
- Serbian (Latin, Serbia)
- Slovak (Slovakia)
- Slovenian (Slovenia)
- Spanish (Spain)
- Swedish (Sweden)
- Thai (Thailand)
- Turkish (Türkiye)
- Ukrainian (Ukraine)
- Vietnamese (Vietnam)
- Welsh (United Kingdom)
Package
2016
787.5 MB
Sources
Updated
Cited passages from Microsoft's official notes (9)
-
1.
This public update delivers Feature Pack 2 for SharePoint Server 2016. Feature Pack 2 contains the following feature: SharePoint Framework (SPFx)
support.microsoft.com -
2.
Administrative Actions Logging
support.microsoft.com -
3.
MinRole enhancements
support.microsoft.com -
4.
SharePoint Custom Tiles
support.microsoft.com -
5.
Hybrid Taxonomy
support.microsoft.com -
6.
OneDrive API for SharePoint on-premises
support.microsoft.com -
7.
The OneDrive for Business modern user experience requires an active Software Assurance contract at the time that the experience is enabled
support.microsoft.com -
8.
This security update resolves Microsoft Outlook Remote Code Execution vulnerability and Microsoft Word Remote Code Execution vulnerability.
support.microsoft.com -
9.
This change enables the Antimalware Scan Interface (AMSI) body scan for HTTP requests in SharePoint 2016.
support.microsoft.com
Checked automatically: 8 of 8 checks passed, 9 quoted passages · compared with Microsoft's page on Oct 20, 2026
- Quotes found in the official pages: passed
- Numbers found in the sources: passed
- Vulnerabilities from the dossier only: passed
- Links to allowed domains only: passed
- Every official change covered: passed
- Readable plain text: passed
- Changes confirmed by the file list: passed
- Sources agree: passed
A second AI read the text against the sources: correctness 5/5, clarity 4/5, completeness 5/5. How we work
Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake