KB5002833: Cumulative update for SharePoint Server, version SE, February 2026. Word and Outlook spoofing flaws patched; farm issues fixed

The update fixes two Important spoofing vulnerabilities affecting Word and Outlook, adds the Version 25H2 feature update, and addresses SharePoint farm, workflow, and document-handling problems.

Does it affect you? Applies to: Computers running the release version of SharePoint Server Subscription Edition. The update package is for x64.

What changes

Fixes 8 changes

Zero downtime updating

Zero-downtime updating is no longer blocked.¹

Calendar lists

For: SharePoint administrators and users

SharePoint worker processes no longer fail with error 0xC0000409 on sites with Calendar lists.²
The issue occurred on sites that have Calendar lists and returned error 0xC0000409.

Site pages accessibility

Checkboxes and expandable controls under the Site pages heading have discernible text available to assistive technology.³

SharePoint 2010 style workflow

Verified in package

The SharePoint 2010 style workflow runs in the SharePoint Timer Service.⁴

w3wp process

Repeated w3wp process failures caused by missing DLLs are fixed.⁵
The failures were caused by missing Dynamic Link Libraries (DLL).

Timer Service Recycle job

The Timer Service Recycle job works again.⁶
The job no longer depends on the removed STSADM.EXE.

PDF upload

For: SharePoint users and administrators

Uploading a PDF no longer causes the w3wp process to stop responding.⁷
The issue affected SharePoint Server Subscription Edition (SPSE).

SharePoint pages

Pages that previously failed to render now render.⁸
The source specifies that this affected certain SharePoint pages.

Improvement 1 change

People Picker

Configurable access controls can limit the People Picker to authorized users by excluding the Everyone claim.⁹
Set $webApp.PeoplePickerSettings.ExcludeEveryoneClaim = $true; the default is False.

New feature 1 change

Version 25H2 feature update

For: SharePoint administrators and users

The Version 25H2 feature update is included, and future public updates will include it too.¹⁰

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released: 2026-02-10
Classification: Security Updates
Type: Cumulative update
Restart: Required
Replaces: KB5002822, KB5002815, KB5002800, KB5002786

+19 earlier
KB5002784, KB5002773, KB5002768, KB5002751, KB5002736, KB5002709, KB5002705, KB5002681, KB5002676, KB5002658, KB5002651, KB5002649, KB5002640, KB5002606, KB5002603, KB5002599, KB5002581, KB5002564, KB5002540
Replaced by: KB5002843

Version	Build	Channel
SE	16.0.19127.20518	General availability

Security

2 vulnerabilities fixed

2 important

Vulnerability	Severity	CVSS
CVE-2026-21260 Microsoft Outlook Spoofing Vulnerability	Important	7.5
CVE-2026-21511 Microsoft Outlook Spoofing Vulnerability	Important	7.5

Downloads (Microsoft Update Catalog)

Package SE

1.6 GB

sts-x-none.cab Main update · KB5002833 SHA-1: 13cbdb42…5d5ea3

Language packs (49)

Updated components

1,187 files changed since the previous update for the same versions.

Top changed components	Files
Search	202
Document conversion	101
Client object model	53
Project Server	33
Document management and policies	11
Office web apps	8
Managed metadata	6
PowerPoint	6
PowerShell	4
Translation Services	3
Workflow	3
Publishing	2

Verified in package: changed files confirm SharePoint 2010 style workflow.

Sources

Updated Oct 26, 2026

Cited passages from Microsoft's official notes (10)

1. Fixes an issue that blocks zero downtime updating. support.microsoft.com
2. Fixes an issue in which the SharePoint worker processes fail and return error 0xC0000409 on sites that have Calendar lists. support.microsoft.com
3. Fixes an accessibility issue in which the discernible text isn't available for checkbox and expandable controls under the Site pages heading. support.microsoft.com
4. Fixes an issue in which the SharePoint 2010 style workflow doesn't run in the SharePoint Timer Service. support.microsoft.com
5. Fixes the repeated failures of w3wp process that are caused by missing Dynamic Link Libraries (DLL). support.microsoft.com
6. Fixes an issue in which the "Timer Service Recycle" job is nonfunctional due to dependency on the removed STSADM.EXE. support.microsoft.com
7. Fixes an issue in which the PDF upload in SharePoint Server Subscription Edition (SPSE) causes the w3wp process to stop responding. support.microsoft.com
8. Fixes an issue in which certain SharePoint pages fail to render. support.microsoft.com
9. Restricts the People Picker to authorized users by excluding the "Everyone" claim through configurable access control settings. support.microsoft.com
10. This security update introduces the SharePoint Server Subscription Edition Version 25H2 feature update. This feature update will be included in all SharePoint Server Subscription Edition public updates going forward. support.microsoft.com

Checked automatically: 8 of 8 checks passed, 10 quoted passages · compared with Microsoft's page on Sep 26, 2026

Quotes found in the official pages: passed
Numbers found in the sources: passed
Vulnerabilities from the dossier only: passed
Links to allowed domains only: passed
Every official change covered: passed
Readable plain text: passed
Changes confirmed by the file list: passed
Sources agree: passed

A second AI read the text against the sources: correctness 5/5, clarity 4/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake