The Update BureauKB5002828: Cumulative update for SharePoint Server, version 2016, January 2026. Seven security flaws addressed; Remote Blob Storage duplication fixed
The update addresses seven security vulnerabilities and fixes data duplication during Remote Blob Storage migration. SharePoint Server 2016 updates end on July 14, 2026.
Does it affect you? Applies to: SharePoint Server 2016 installations with the release version installed. The update package is for x64 systems and produces build 16.0.5535.1001.
Microsoft ships this release as two packages: KB5002828, the update itself, and KB5002827 for the language packs. Install both on every server of the farm, then run the SharePoint Products Configuration Wizard.
What changes
Fixes 2 changes
Security
For: SharePoint Server 2016 administrators
-
The update addresses seven security vulnerabilities affecting Office Click-to-Run, SharePoint, and Word.1
The listed CVEs are CVE-2026-20943, CVE-2026-20948, CVE-2026-20963, CVE-2026-20958, CVE-2026-20951, CVE-2026-20959, and CVE-2026-20947.
Remote Blob Storage
For: SharePoint Server 2016 administrators
- Data duplication during Remote Blob Storage migration is fixed.2
New features 2 changes
SharePoint Framework
For: SharePoint Server 2016 administrators and users
-
The update delivers Feature Pack 2, which includes SharePoint Framework.3
SharePoint Framework (SPFx).
Feature Pack 1
For: SharePoint Server 2016 administrators; the modern OneDrive for Business experience is for Software Assurance customers
-
The update also includes Feature Pack 1 features: Administrative Actions Logging, MinRole enhancements, SharePoint Custom Tiles, Hybrid Taxonomy, the OneDrive API for on-premises SharePoint, and the modern OneDrive for Business experience.3
The modern OneDrive for Business experience is available to Software Assurance customers. An active Software Assurance contract is required when enabling it; without one, turn the experience off.
Technical details
Data sheet · Security · Downloads · Components Click to collapse or expand
Data sheet
- Released
- 2026-01-13
- Classification
- Security Updates
- Type
- Cumulative update
- Restart
- Required
- Replaces
- KB5002821, KB5002805, KB5002788, KB5002778
- Replaced by
- KB5002841
| Version | Build | Channel |
|---|---|---|
| 2016 | 16.0.5535.1001 | General availability |
Security
| Vulnerability | Severity | CVSS |
|---|---|---|
|
Microsoft SharePoint Remote Code Execution Vulnerability
|
Important | 9.8 |
|
Microsoft SharePoint Server Remote Code Execution Vulnerability
|
Important | 8.8 |
|
Microsoft Word Remote Code Execution Vulnerability
|
Important | 7.8 |
|
Microsoft SharePoint Server Remote Code Execution Vulnerability
|
Important | 7.8 |
|
Microsoft Office Click-To-Run Remote Code Execution Vulnerability
|
Important | 7.0 |
|
Microsoft SharePoint Information Disclosure Vulnerability
|
Important | 5.4 |
|
Microsoft SharePoint Server Spoofing Vulnerability
|
Important | 4.6 |
Downloads (Microsoft Update Catalog)
Language packs (51)
- Arabic (Saudi Arabia)
- Azerbaijani (Latin, Azerbaijan)
- Basque (Spain)
- Bosnian (Latin, Bosnia & Herzegovina)
- Bulgarian (Bulgaria)
- Catalan (Spain)
- Chinese (China)
- Chinese (Taiwan)
- Croatian (Croatia)
- Czech (Czechia)
- Danish (Denmark)
- Dari (Afghanistan)
- Dutch (Netherlands)
- English (United States)
- Estonian (Estonia)
- Finnish (Finland)
- French (France)
- Galician (Spain)
- German (Germany)
- Greek (Greece)
- Hebrew (Israel)
- Hindi (India)
- Hungarian (Hungary)
- Indonesian (Indonesia)
- Irish (Ireland)
- Italian (Italy)
- Japanese (Japan)
- Kazakh (Kazakhstan)
- Korean (South Korea)
- Latvian (Latvia)
- Lithuanian (Lithuania)
- Macedonian (North Macedonia)
- Malay (Malaysia)
- Norwegian Bokmål (Norway)
- Polish (Poland)
- Portuguese (Brazil)
- Portuguese (Portugal)
- Romanian (Romania)
- Russian (Russia)
- Serbian (Cyrillic, Serbia)
- Serbian (Latin, Serbia)
- Serbian (Latin, Serbia)
- Slovak (Slovakia)
- Slovenian (Slovenia)
- Spanish (Spain)
- Swedish (Sweden)
- Thai (Thailand)
- Turkish (Türkiye)
- Ukrainian (Ukraine)
- Vietnamese (Vietnam)
- Welsh (United Kingdom)
Updated components
100 files changed since the previous update for the same versions.
| Top changed components | Files |
|---|---|
| Document conversion | 9 |
| Client object model | 7 |
| Managed metadata | 5 |
| Access Services | 1 |
| Document management and policies | 1 |
| PowerPoint | 1 |
| Project Server | 1 |
Sources
Cited passages from Microsoft's official notes (3)
-
1.
This security update resolves Microsoft Office Click-To-Run Elevation of Privilege vulnerability, Microsoft SharePoint Remote Code Execution vulnerability, Microsoft SharePoint Information Disclosure vulnerability
support.microsoft.com -
2.
This update fixes the data duplication issue that occurs during the Remote Blob Storage (RBS) migration.
support.microsoft.com -
3.
This public update delivers Feature Pack 2 for SharePoint Server 2016. Feature Pack 2 contains the following feature:
support.microsoft.com
Checked automatically: 8 of 8 checks passed, 3 quoted passages · compared with Microsoft's page on Sep 26, 2026
- Quotes found in the official pages: passed
- Numbers found in the sources: passed
- Vulnerabilities from the dossier only: passed
- Links to allowed domains only: passed
- Every official change covered: passed
- Readable plain text: passed
- Changes confirmed by the file list: passed
- Sources agree: passed
A second AI read the text against the sources: correctness 5/5, clarity 4/5, completeness 5/5. How we work
Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake