Skip to the content
The Update Bureau
SharePoint Server SE SharePoint Server SE Security update
Patch Tuesday

KB5002843

KB5002843: Cumulative update for SharePoint Server, version SE, March 2026. Critical Office code-execution flaw fixed; direct upgrade can fail

In short

The update fixes three security vulnerabilities, including a critical Office remote-code execution flaw. SharePoint Server Subscription Edition farms moving directly from the January to March update can hit a PSConfig failure.

Does it affect you? Applies to: Computers running the release version of SharePoint Server Subscription Edition. The update package is for x64.

Build
16.0.19725.20076
Security
3 fixed · 1 critical
Restart
Required

What changes

Fixes 3 changes

Security

  • The update fixes a critical Office remote-code execution vulnerability and SharePoint Server remote-code execution and spoofing vulnerabilities.1
    CVE-2026-26113 is the critical Microsoft Office remote code execution vulnerability.

Secure Store

  • The Secure Store Target application no longer shows the “Group claim validation failed” error.2

SharePoint Administration service

For: SharePoint Server administrators on Windows Server 2025

  • The SharePoint Administration service starts on Windows Server 2025.3

Improvements 2 changes

Hybrid Search

Verified in package 2 items

For: SharePoint Server administrators using Hybrid Search

  • Hybrid Search makes fewer redundant onboarding requests and waits 15 minutes between consecutive failures.4
  • The Hybrid Search onboarding script uses a customer-owned application.5

Known issues

  1. Open Affects: Organizations and IT administrators

    For SharePoint Server Subscription Edition customers who are currently on the January 2026 public update, updating directly to the March 2026 public update fails when you run the SharePoint Products Configuration Wizard (PSConfig).

    For farms on the January 2026 public update, upgrading directly to the March 2026 update fails when you run the SharePoint Products Configuration Wizard (PSConfig).6

    How to apply the workaround Workaround

    Include the February 2026 update in the upgrade sequence, and run PSConfig immediately after the February update and again after the March update.6

    Step-by-step workaround instructions
    2 steps
    Show steps Hide steps
    Step-by-step procedure
    1. Install KB5002822 (January 2026), then KB5002833 (February 2026), then KB5002843 (March 2026).
    2. Run PSConfig immediately after installing the February update and again after the March update.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2026-03-10
Classification
Security Updates
Type
Cumulative update
Restart
Required
Replaces
KB5002833, KB5002822, KB5002815, KB5002800
+20 earlier KB5002786, KB5002784, KB5002773, KB5002768, KB5002751, KB5002736, KB5002709, KB5002705, KB5002681, KB5002676, KB5002658, KB5002651, KB5002649, KB5002640, KB5002606, KB5002603, KB5002599, KB5002581, KB5002564, KB5002540
Replaced by
KB5002853
VersionBuildChannel
SE 16.0.19725.20076 General availability

Security

3 vulnerabilities fixed
1 critical 2 important
VulnerabilitySeverityCVSS
CVE-2026-26113
Microsoft Office Remote Code Execution Vulnerability
 Critical 8.4
CVE-2026-26106
Microsoft SharePoint Server Remote Code Execution Vulnerability
 Important 8.8
CVE-2026-26105
Microsoft SharePoint Server Spoofing Vulnerability
 Important 8.1

Updated components

1,292 files changed since the previous update for the same versions.

Top changed componentsFiles
Search202
Document conversion104
Client object model53
Project Server33
Document management and policies11
Office web apps8
Managed metadata6
PowerPoint6
PowerShell4
Translation Services3
Workflow3
Publishing2

Verified in package: changed files confirm Hybrid Search.

Sources

Updated
Cited passages from Microsoft's official notes (6)
  1. 1. This security update resolves a Microsoft office remote code execution vulnerability, Microsoft SharePoint Server remote code execution vulnerability and Microsoft SharePoint Server spoofing vulnerability. support.microsoft.com
  2. 2. Fixes the Secure Store Target application “Group claim validation failed” error. support.microsoft.com
  3. 3. Fixes an issue in which the SharePoint Administration service doesn't start on Windows Server 2025. support.microsoft.com
  4. 4. Reduces redundant Hybrid Search onboarding requests and increases the retry interval between consecutive failures to 15 minutes. support.microsoft.com
  5. 5. Enhances the Hybrid Search onboarding script by using a customer-owned application. support.microsoft.com
  6. 6. customers who are currently on the January 2026 public update, updating directly to the March 2026 public update fails when you run the SharePoint Products Configuration Wizard (PSConfig). support.microsoft.com
Checked automatically: 7 of 8 checks passed, 6 quoted passages · compared with Microsoft's page on Sep 26, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: not passed

A second AI read the text against the sources: correctness 5/5, clarity 4/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake