The Update BureauKB5002868: Cumulative update for SharePoint Server, version 2016, May 2026. Critical server code-execution flaw; some pages fail to render
In short
The update addresses 9 vulnerabilities, including critical remote-code execution flaws in SharePoint Server and Word. It also fixes rendering on some SharePoint pages.
Does it affect you? Applies to: SharePoint Server 2016 farms running the release version of the product. The update package is for x64 and produces build 16.0.5552.1002.
Review notes Additional details from the official release notes (2) Read notes
- In detail Only farms currently running SharePoint Workflow Manager must install KB5002799 before this update.
- This page This update fixes an issue in which some SharePoint pages do not render.
The official sources are linked at the end of the page.
Microsoft ships this release as two packages: KB5002868, the update itself, and KB5002869 for the language packs. Install both on every server of the farm, then run the SharePoint Products Configuration Wizard.
What changes
New features 2 changes
SharePoint Framework (SPFx)
- Feature Pack 2, which includes SharePoint Framework (SPFx), is delivered with this update.1
Feature Pack 1
- The update also delivers Administrative Actions Logging, MinRole enhancements, SharePoint Custom Tiles, Hybrid Taxonomy, the OneDrive API for SharePoint on-premises, and the OneDrive for Business modern user experience. The modern user experience requires active Software Assurance when enabled; without it, you must turn that experience off.2
Fix 1 change
SharePoint pages
- Some SharePoint pages render again.3
Technical details
Data sheet · Security · Downloads · Components Click to collapse or expand
Data sheet
- Released
- 2026-05-12
- Classification
- Security Updates
- Type
- Cumulative update
- Restart
- Required
- Replaces
- KB5002861, KB5002850, KB5002841, KB5002828
| Version | Build | Channel |
|---|---|---|
| 2016 | 16.0.5552.1002 | General availability |
Security
| Vulnerability | Severity | CVSS |
|---|---|---|
|
Microsoft SharePoint Server Remote Code Execution Vulnerability
|
Critical | 8.8 |
|
Microsoft Word Remote Code Execution Vulnerability
|
Critical | 8.4 |
|
Microsoft SharePoint Server Remote Code Execution Vulnerability
|
Important | 8.8 |
|
Microsoft SharePoint Server Remote Code Execution Vulnerability
|
Important | 8.8 |
|
Microsoft SharePoint Server Remote Code Execution Vulnerability
|
Important | 8.8 |
|
Microsoft SharePoint Server Remote Code Execution Vulnerability
|
Important | 8.8 |
|
Microsoft SharePoint Remote Code Execution Vulnerability
|
Important | 8.8 |
|
Microsoft SharePoint Server Remote Code Execution Vulnerability
|
Important | 8.0 |
|
Microsoft SharePoint Server Remote Code Execution Vulnerability
|
Important | 8.0 |
Downloads (Microsoft Update Catalog)
Package
2016
558.4 MB
wss-x-none.cab
Language packs (51)
- Arabic (Saudi Arabia)
- Azerbaijani (Latin, Azerbaijan)
- Basque (Spain)
- Bosnian (Latin, Bosnia & Herzegovina)
- Bulgarian (Bulgaria)
- Catalan (Spain)
- Chinese (China)
- Chinese (Taiwan)
- Croatian (Croatia)
- Czech (Czechia)
- Danish (Denmark)
- Dari (Afghanistan)
- Dutch (Netherlands)
- English (United States)
- Estonian (Estonia)
- Finnish (Finland)
- French (France)
- Galician (Spain)
- German (Germany)
- Greek (Greece)
- Hebrew (Israel)
- Hindi (India)
- Hungarian (Hungary)
- Indonesian (Indonesia)
- Irish (Ireland)
- Italian (Italy)
- Japanese (Japan)
- Kazakh (Kazakhstan)
- Korean (South Korea)
- Latvian (Latvia)
- Lithuanian (Lithuania)
- Macedonian (North Macedonia)
- Malay (Malaysia)
- Norwegian Bokmål (Norway)
- Polish (Poland)
- Portuguese (Brazil)
- Portuguese (Portugal)
- Romanian (Romania)
- Russian (Russia)
- Serbian (Cyrillic, Serbia)
- Serbian (Latin, Serbia)
- Serbian (Latin, Serbia)
- Slovak (Slovakia)
- Slovenian (Slovenia)
- Spanish (Spain)
- Swedish (Sweden)
- Thai (Thailand)
- Turkish (Türkiye)
- Ukrainian (Ukraine)
- Vietnamese (Vietnam)
- Welsh (United Kingdom)
Package
2016
787.5 MB
Updated components
4,225 files changed since the previous update for the same versions.
| Top changed components | Files |
|---|---|
| Search | 59 |
| Project Server | 27 |
| Client object model | 18 |
| Document conversion | 16 |
| Access Services | 13 |
| Document management and policies | 7 |
| Managed metadata | 6 |
| PowerPoint | 3 |
| Excel | 2 |
| PowerShell | 2 |
| Translation Services | 2 |
| Workflow | 2 |
Sources
Updated
Cited passages from Microsoft's official notes (3)
-
1.
This public update delivers Feature Pack 2 for SharePoint Server 2016. Feature Pack 2 contains the following feature:
support.microsoft.com -
2.
This public update also delivers all the features that were included in Feature Pack 1 for SharePoint Server 2016, including:
support.microsoft.com -
3.
Fixes an issue in which some SharePoint pages don't render.
support.microsoft.com
Checked automatically: 7 of 8 checks passed, 3 quoted passages · compared with Microsoft's page on Sep 26, 2026
- Quotes found in the official pages: passed
- Numbers found in the sources: passed
- Vulnerabilities from the dossier only: passed
- Links to allowed domains only: passed
- Every official change covered: passed
- Readable plain text: passed
- Changes confirmed by the file list: passed
- Sources agree: not passed
A second AI read the text against the sources: correctness 3/5, clarity 4/5, completeness 5/5. How we work
Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake