Skip to the content
The Update Bureau
SharePoint Server 2016 SharePoint Server 2016 Security update
Patch Tuesday

KB5002841

KB5002841: Cumulative update for SharePoint Server, version 2016, February 2026. Word and Outlook spoofing flaws fixed; machine-key setting restored

In short

The update fixes two Important spoofing vulnerabilities affecting Word and Outlook, and restores the ability to set SharePoint machine keys after the September 2025 cumulative update.

Does it affect you? Applies to: SharePoint Server 2016 farms with the release version installed. The package is for x64 systems.

Build
16.0.5539.1002
Security
2 fixed
Restart
Required

Microsoft ships this release as two packages: KB5002841, the update itself, and KB5002840 for the language packs. Install both on every server of the farm, then run the SharePoint Products Configuration Wizard.

What changes

New features 7 changes

SharePoint Framework (SPFx)

For: SharePoint developers

  • SharePoint Framework is included as part of Feature Pack 2.1

Administrative Actions Logging

  • Administrative Actions Logging is included among the features delivered from Feature Pack 1.2

MinRole enhancements

  • MinRole enhancements are included among the features delivered from Feature Pack 1.2

SharePoint Custom Tiles

  • SharePoint Custom Tiles are included among the features delivered from Feature Pack 1.2

Hybrid Taxonomy

  • Hybrid Taxonomy is included among the features delivered from Feature Pack 1.2

OneDrive API for SharePoint on-premises

For: SharePoint developers

  • The OneDrive API for SharePoint on-premises is included among the features delivered from Feature Pack 1.2

OneDrive for Business modern user experience

For: Software Assurance customers

  • The OneDrive for Business modern user experience is included among the features delivered from Feature Pack 1.3
    An active Software Assurance contract is required when the experience is enabled, either through this update or manually. Without an active contract at enablement, turn off the experience.

Fixes 3 changes

Microsoft Word and Microsoft Outlook

For: SharePoint Server 2016 users

  • Spoofing vulnerabilities affecting Word and Outlook are addressed.4
    The update resolves CVE-2026-21511 and CVE-2026-21260.

Set-SPMachineKey

  • Administrators can use Set-SPMachineKey to set machine keys again after the September 2025 cumulative update.5
    Fixes the issue that prevented Set-SPMachineKey from setting machine keys after the September 2025 cumulative update.

w3wp process

  • Fixes an issue in which the w3wp process repeatedly stops responding.6
    Fixes an issue in which the w3wp process stops responding repeatedly.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2026-02-10
Classification
Security Updates
Type
Cumulative update
Restart
Required
Replaces
KB5002828, KB5002821, KB5002805, KB5002788
+4 earlier KB5002778, KB5002771, KB5002760, KB5002744
Replaced by
KB5002850
VersionBuildChannel
2016 16.0.5539.1002 General availability

Security

2 vulnerabilities fixed
2 important
VulnerabilitySeverityCVSS
CVE-2026-21260
Microsoft Outlook Spoofing Vulnerability
 Important 7.5
CVE-2026-21511
Microsoft Outlook Spoofing Vulnerability
 Important 7.5

Updated components

51 files changed since the previous update for the same versions.

Top changed componentsFiles
Access Services1
Client object model1
Document conversion1
PowerShell1
Project Server1

Sources

Updated
Cited passages from Microsoft's official notes (6)
  1. 1. This public update delivers Feature Pack 2 for SharePoint Server 2016. Feature Pack 2 contains the following feature: - SharePoint Framework (SPFx) support.microsoft.com
  2. 2. Administrative Actions Logging - MinRole enhancements - SharePoint Custom Tiles - Hybrid Taxonomy - OneDrive API for SharePoint on-premises support.microsoft.com
  3. 3. The OneDrive for Business modern user experience requires an active Software Assurance contract at the time that the experience is enabled, either by installation of the public update or by manual enablement. support.microsoft.com
  4. 4. This security update resolves Microsoft Word spoofing vulnerability and Microsoft Outlook spoofing vulnerability. support.microsoft.com
  5. 5. This update fixes an issue in which Set-SPMachineKey can no longer be used to set machine keys after the September 2025 cumulative update is installed. support.microsoft.com
  6. 6. Fixes an issue in which the w3wp process stops responding repeatedly. support.microsoft.com
Checked automatically: 8 of 8 checks passed, 6 quoted passages · compared with Microsoft's page on Sep 26, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: passed

A second AI read the text against the sources: correctness 5/5, clarity 4/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake