KB5002863: SharePoint Server SE update, May 2026

What changes

The update addresses a remote code execution vulnerability in SharePoint Server.¹

Resolves page-loading failures caused by some user controls being flagged as unsafe. Affected controls can be trusted by configuring a custom farm property.²
The property is (AllowedTagPrefixesWhichAreNotWebControlsList).

The “Sorry, something went wrong” screen no longer appears when customers update settings in the Configure and Health SA page.³

Verified in package

PowerShell no longer incorrectly reports a “Database already exists” error when settings are updated against an existing database.⁴

Ingestion throughput improves.⁶
The update increases the hit rate of the cache used during ingestion.

Data sheet · Security · Downloads · Components Click to collapse or expand

Released: 2026-05-12
Classification: Security Updates
Type: Cumulative update
Restart: Required
Replaces: KB5002853, KB5002843, KB5002833, KB5002822

+22 earlier
KB5002815, KB5002800, KB5002786, KB5002784, KB5002773, KB5002768, KB5002751, KB5002736, KB5002709, KB5002705, KB5002681, KB5002676, KB5002658, KB5002651, KB5002649, KB5002640, KB5002606, KB5002603, KB5002599, KB5002581, KB5002564, KB5002540
Replaced by: KB5002873

Version	Build	Channel
SE	16.0.19725.20280	General availability

9 vulnerabilities fixed

2 critical 7 important

Vulnerability	Severity	CVSS
CVE-2026-40365 Microsoft SharePoint Server Remote Code Execution Vulnerability	Critical	8.8
CVE-2026-40367 Microsoft Word Remote Code Execution Vulnerability	Critical	8.4
CVE-2026-33110 Microsoft SharePoint Server Remote Code Execution Vulnerability	Important	8.8
CVE-2026-33112 Microsoft SharePoint Server Remote Code Execution Vulnerability	Important	8.8
CVE-2026-35439 Microsoft SharePoint Server Remote Code Execution Vulnerability	Important	8.8
CVE-2026-40357 Microsoft SharePoint Server Remote Code Execution Vulnerability	Important	8.8
CVE-2026-45659 Microsoft SharePoint Remote Code Execution Vulnerability	Important	8.8
CVE-2026-40368 Microsoft SharePoint Server Remote Code Execution Vulnerability	Important	8.0
CVE-2026-47294 Microsoft SharePoint Server Remote Code Execution Vulnerability	Important	8.0

Package SE

1.6 GB

Language packs (49)

1,106 files changed since the previous update for the same versions.

Top changed components	Files
Search	202
Document conversion	100
Client object model	53
Project Server	33
Document management and policies	11
Office web apps	8
Managed metadata	6
PowerPoint	6
PowerShell	4
Translation Services	3
Workflow	3
Publishing	2

Verified in package: changed files confirm PowerShell.

Updated Oct 26, 2026

Cited passages from Microsoft's official notes (6)

1. This security update resolves Microsoft SharePoint Server Remote Code Execution vulnerability. support.microsoft.com
2. This update resolves an issue in which pages don't load because certain user controls are flagged as unsafe for security. support.microsoft.com
3. This update fixes an issue in which customers encounter a “Sorry, something went wrong” screen when they update settings in the Configure and Health SA page. support.microsoft.com
4. It also resolves a problem in which PowerShell incorrectly reports a “Database already exists” error, even if customers are only updating settings against an existing database. support.microsoft.com
5. This update improves accessibility by enabling keyboard navigation to column headers in the SPList Quick Edit view. support.microsoft.com
6. This update improves ingestion throughput by increasing the hit rate of the cache that's used during the ingestion process. support.microsoft.com

Checked automatically: 7 of 8 checks passed, 6 quoted passages · compared with Microsoft's page on Sep 26, 2026

A second AI read the text against the sources: correctness 5/5, clarity 4/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake