The Update BureauKB5002822: Cumulative update for SharePoint Server, version SE, January 2026. Eight vulnerabilities addressed as the 25H2 feature update arrives
In short
The update addresses eight vulnerabilities and introduces the 25H2 feature update. It also fixes SharePoint issues affecting accessibility, content display, and data migration.
Does it affect you? Applies to: SharePoint Server Subscription Edition farms running the release version. The update package is for x64.
What changes
Fixes 11 changes
SharePoint security
-
The update addresses security vulnerabilities affecting Office Click-to-Run, Word, and SharePoint.1
The page lists elevation of privilege, remote code execution, information disclosure, and spoofing vulnerabilities.
GB18030-2022
- The GB18030-2022 certification issue is fixed.2
People Picker
-
Groups with special characters in their names can be resolved by the People Picker.3
Fixes the UPA-backed claims provider failing to resolve groups whose names contain special characters.
Modern information panel
-
DateOnly columns no longer display the time in the modern information panel.4
Fixes the DateOnly column displaying the time in the modern information panel.
Links
-
Some links now have readable text or alternative text instead of only an image or icon.5
Fixes links that lack discernible text or contain only images or icons without accessible alternative text.
Drop an image section option
-
Keyboard navigation shows focus on the Drop an image option, and its hover-triggered popup appears.6
Fixes missing keyboard focus and the hover-triggered popup window for the Drop an image section option.
Image gallery
-
Keyboard navigation stays in the Image gallery layout property pane.7
Fixes focus leaving the Image gallery layout property pane when navigating with Tab.
Text and table formatting
-
Keyboard navigation stays in the Font color popup window.8
Fixes focus leaving the Font color popup window in the Text and tableformatting pane when navigating with Tab.
Permissions dialog box
- An accessibility issue in the Permissions dialog box is fixed.9
Info icon
- The info icon is accessible when you navigate by keyboard.10
Remote Blob Storage migration
-
Data duplication during Remote Blob Storage migration is fixed.11
Fixes the data duplication issue that occurs during the Remote Blob Storage (RBS) migration.
Improvements 4 changes
SharePoint Workflow Manager
Verified in package
-
Farms running SharePoint Workflow Manager need its November update before installing this cumulative update.12
Install SharePoint Workflow Manager KB5002799 to the farm before applying this update.
Classic Workflow Manager
Verified in package
For: SharePoint administrators using Classic Workflow Manager
-
Classic Workflow Manager can continue to be used after its debug flag is enabled.13
Run
$farm = Get-SPFarm,$farm.ServerDebugFlags.Add(53601),$farm.update(), theniisreset.
SharePoint
-
SharePoint can block URLs through integration with the ECS .NET Client library.14
Integrates SharePoint Server with the ECS .NET Client library to enable URL blocking.
Favorites panel
-
The star icon in the Favorites panel is brighter and easier to see.15
Adjusts the brightness of the star icon in the Favorites panel.
New feature 1 change
SharePoint Server Subscription Edition
For: SharePoint administrators and users
-
The 25H2 feature update is included. Future public updates will also include it.16
Introduces SharePoint Server Subscription Edition Version 25H2.
Technical details
Data sheet · Security · Downloads · Components Click to collapse or expand
Data sheet
- Released
- 2026-01-13
- Classification
- Security Updates
- Type
- Cumulative update
- Restart
- Required
- Replaces
- KB5002815, KB5002800, KB5002786, KB5002784
- Replaced by
- KB5002833
| Version | Build | Channel |
|---|---|---|
| SE | 16.0.19127.20442 | General availability |
Security
| Vulnerability | Severity | CVSS |
|---|---|---|
|
Microsoft SharePoint Remote Code Execution Vulnerability
|
Important | 9.8 |
|
Microsoft SharePoint Server Remote Code Execution Vulnerability
|
Important | 8.8 |
|
Microsoft SharePoint Server Remote Code Execution Vulnerability
|
Important | 7.8 |
|
Microsoft Office Click-To-Run Remote Code Execution Vulnerability
|
Important | 7.0 |
|
Microsoft SharePoint Information Disclosure Vulnerability
|
Important | 5.4 |
|
Microsoft SharePoint Server Spoofing Vulnerability
|
Important | 4.6 |
| Not rated | — | |
| Not rated | — |
Downloads (Microsoft Update Catalog)
Package
SE
1.6 GB
sts-x-none.cab
Language packs (49)
- Arabic (Saudi Arabia)
- Azerbaijani (Latin, Azerbaijan)
- Basque (Spain)
- Bosnian (Latin, Bosnia & Herzegovina)
- Bulgarian (Bulgaria)
- Catalan (Spain)
- Chinese (China)
- Chinese (Taiwan)
- Croatian (Croatia)
- Czech (Czechia)
- Danish (Denmark)
- Dutch (Netherlands)
- English (United States)
- Estonian (Estonia)
- Finnish (Finland)
- French (France)
- Galician (Spain)
- German (Germany)
- Greek (Greece)
- Hebrew (Israel)
- Hindi (India)
- Hungarian (Hungary)
- Indonesian (Indonesia)
- Irish (Ireland)
- Italian (Italy)
- Japanese (Japan)
- Kazakh (Kazakhstan)
- Korean (South Korea)
- Latvian (Latvia)
- Lithuanian (Lithuania)
- Macedonian (North Macedonia)
- Malay (Malaysia)
- Norwegian Bokmål (Norway)
- Polish (Poland)
- Portuguese (Brazil)
- Portuguese (Portugal)
- Romanian (Romania)
- Russian (Russia)
- Serbian (Cyrillic, Serbia)
- Serbian (Latin, Serbia)
- Slovak (Slovakia)
- Slovenian (Slovenia)
- Spanish (Spain)
- Swedish (Sweden)
- Thai (Thailand)
- Turkish (Türkiye)
- Ukrainian (Ukraine)
- Vietnamese (Vietnam)
- Welsh (United Kingdom)
Updated components
1,205 files changed since the previous update for the same versions.
| Top changed components | Files |
|---|---|
| Search | 202 |
| Document conversion | 100 |
| Client object model | 53 |
| Project Server | 33 |
| Office web apps | 8 |
| Document management and policies | 6 |
| Managed metadata | 6 |
| PowerPoint | 6 |
| PowerShell | 4 |
| Translation Services | 3 |
| Workflow | 3 |
| Publishing | 2 |
Verified in package: changed files confirm SharePoint Workflow Manager, Classic Workflow Manager.
Sources
Cited passages from Microsoft's official notes (16)
-
1.
This security update resolves a Microsoft Office Click-To-Run Elevation of Privilege vulnerability, Microsoft Word Remote Code Execution, Microsoft SharePoint Remote Code Execution vulnerability, Microsoft SharePoint Information Disclosure vulnerability
support.microsoft.com -
2.
This update fixes the GB18030-2022 certification issue.
support.microsoft.com -
3.
This update fixes an issue in which the UPA‑backed claims provider doesn't resolve groups in the People Picker if a group name contains special characters.
support.microsoft.com -
4.
This update fixes an issue that causes the DateOnly column to also display the time in the modern information panel.
support.microsoft.com -
5.
This update fixes an issue in which some links lack discernible text or contain only images or icons without accessible alternative text.
support.microsoft.com -
6.
This update fixes an issue in which the Drop an image section option doesn't appear focused when you navigate by using the keyboard and doesn't display any hover-triggered popup window.
support.microsoft.com -
7.
This update fixes an issue in which the focus leaves the Image gallery layout property pane when you navigate by using the Tab key.
support.microsoft.com -
8.
This update fixes an issue in which the focus leaves the Font color popup window in the Text and tableformatting pane when you navigate by using the Tab key.
support.microsoft.com -
9.
This update fixes an accessibility issue in the Permissions dialog box.
support.microsoft.com -
10.
This update fixes an accessibility issue by making the info icon accessible when you navigate by using the keyboard.
support.microsoft.com -
11.
This update fixes the data duplication issue that occurs during the Remote Blob Storage (RBS) migration.
support.microsoft.com -
12.
If you're currently running SharePoint Workflow Manager, you must install SharePoint Workflow Manager (KB5002799) to your farm before you install this cumulative update.
support.microsoft.com -
13.
If you're currently running the Classic version of Workflow Manager, you have to enable the debug flag in order to continue using it:
support.microsoft.com -
14.
This update integrates SharePoint Server with the ECS .NET Client library to enable URL blocking.
support.microsoft.com -
15.
This update adjusts the brightness of the star icon in the Favorites panel for better visibility.
support.microsoft.com -
16.
This security update introduces the SharePoint Server Subscription Edition Version 25H2 feature update. This feature update will be included in all SharePoint Server Subscription Edition public updates going forward.
support.microsoft.com
Checked automatically: 7 of 8 checks passed, 16 quoted passages · compared with Microsoft's page on Sep 26, 2026
- Quotes found in the official pages: passed
- Numbers found in the sources: passed
- Vulnerabilities from the dossier only: passed
- Links to allowed domains only: passed
- Every official change covered: passed
- Readable plain text: passed
- Changes confirmed by the file list: passed
- Sources agree: not passed
A second AI read the text against the sources: correctness 5/5, clarity 5/5, completeness 5/5. How we work
Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake