The Update BureauKB5002850: Cumulative update for SharePoint Server, version 2016, March 2026. Critical Office remote-code flaw patched; pages render again
The update closes four vulnerabilities, including a critical Office remote-code flaw, and fixes an issue that kept some pages from rendering. It also delivers SharePoint Framework (SPFx).
Does it affect you? Applies to: Devices running the release version of SharePoint Server 2016. The update package is for x64 systems.
Microsoft ships this release as two packages: KB5002850, the update itself, and KB5002851 for the language packs. Install both on every server of the farm, then run the SharePoint Products Configuration Wizard.
What changes
Fixes 2 changes
Security
For: SharePoint Server 2016 administrators
-
Remote code execution vulnerabilities in SharePoint Server and Office, and a SharePoint Server spoofing vulnerability, are resolved.1
Includes CVE-2026-26113, CVE-2026-26114, CVE-2026-26106, and CVE-2026-26105.
SharePoint pages
- Some SharePoint pages render again instead of failing to render.2
New features 2 changes
SharePoint Framework (SPFx)
For: SharePoint developers and administrators
- Feature Pack 2 adds SharePoint Framework (SPFx).3
Feature Pack 1
For: SharePoint administrators and Software Assurance customers
-
The update also delivers Feature Pack 1 features, including new administration, hybrid, and OneDrive capabilities.4
Includes Administrative Actions Logging, MinRole enhancements, SharePoint Custom Tiles, Hybrid Taxonomy, and the OneDrive API for SharePoint on-premises. The OneDrive for Business modern user experience is also included, but requires an active Software Assurance contract when enabled; without one, turn off that experience.
Technical details
Data sheet · Security · Downloads · Components Click to collapse or expand
Data sheet
- Released
- 2026-03-10
- Classification
- Security Updates
- Type
- Cumulative update
- Restart
- Required
- Replaces
- KB5002841, KB5002828, KB5002821, KB5002805
- Replaced by
- KB5002861
| Version | Build | Channel |
|---|---|---|
| 2016 | 16.0.5543.1000 | General availability |
Security
| Vulnerability | Severity | CVSS |
|---|---|---|
|
Microsoft Office Remote Code Execution Vulnerability
|
Critical | 8.4 |
|
Microsoft SharePoint Server Remote Code Execution Vulnerability
|
Important | 8.8 |
|
Microsoft SharePoint Server Remote Code Execution Vulnerability
|
Important | 8.8 |
|
Microsoft SharePoint Server Spoofing Vulnerability
|
Important | 8.1 |
Downloads (Microsoft Update Catalog)
Language packs (51)
- Arabic (Saudi Arabia)
- Azerbaijani (Latin, Azerbaijan)
- Basque (Spain)
- Bosnian (Latin, Bosnia & Herzegovina)
- Bulgarian (Bulgaria)
- Catalan (Spain)
- Chinese (China)
- Chinese (Taiwan)
- Croatian (Croatia)
- Czech (Czechia)
- Danish (Denmark)
- Dari (Afghanistan)
- Dutch (Netherlands)
- English (United States)
- Estonian (Estonia)
- Finnish (Finland)
- French (France)
- Galician (Spain)
- German (Germany)
- Greek (Greece)
- Hebrew (Israel)
- Hindi (India)
- Hungarian (Hungary)
- Indonesian (Indonesia)
- Irish (Ireland)
- Italian (Italy)
- Japanese (Japan)
- Kazakh (Kazakhstan)
- Korean (South Korea)
- Latvian (Latvia)
- Lithuanian (Lithuania)
- Macedonian (North Macedonia)
- Malay (Malaysia)
- Norwegian Bokmål (Norway)
- Polish (Poland)
- Portuguese (Brazil)
- Portuguese (Portugal)
- Romanian (Romania)
- Russian (Russia)
- Serbian (Cyrillic, Serbia)
- Serbian (Latin, Serbia)
- Serbian (Latin, Serbia)
- Slovak (Slovakia)
- Slovenian (Slovenia)
- Spanish (Spain)
- Swedish (Sweden)
- Thai (Thailand)
- Turkish (Türkiye)
- Ukrainian (Ukraine)
- Vietnamese (Vietnam)
- Welsh (United Kingdom)
Updated components
222 files changed since the previous update for the same versions.
| Top changed components | Files |
|---|---|
| Client object model | 7 |
| Document conversion | 3 |
| Managed metadata | 3 |
| Access Services | 1 |
| PowerShell | 1 |
| Project Server | 1 |
Sources
Cited passages from Microsoft's official notes (4)
-
1.
This security update resolves Microsoft SharePoint server remote code execution vulnerability, Microsoft Office remote code execution vulnerability, and Microsoft SharePoint server spoofing vulnerability.
support.microsoft.com -
2.
Fixes an issue in which some SharePoint pages don't render.
support.microsoft.com -
3.
This public update delivers Feature Pack 2 for SharePoint Server 2016. Feature Pack 2 contains the following feature: - SharePoint Framework (SPFx)
support.microsoft.com -
4.
This public update also delivers all the features that were included in Feature Pack 1 for SharePoint Server 2016, including:
support.microsoft.com
Checked automatically: 7 of 8 checks passed, 4 quoted passages · compared with Microsoft's page on Sep 26, 2026
- Quotes found in the official pages: passed
- Numbers found in the sources: passed
- Vulnerabilities from the dossier only: passed
- Links to allowed domains only: passed
- Every official change covered: passed
- Readable plain text: passed
- Changes confirmed by the file list: passed
- Sources agree: not passed
A second AI read the text against the sources: correctness 5/5, clarity 4/5, completeness 5/5. How we work
Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake