The Update BureauKB5002870: Cumulative update for SharePoint Server, version 2019, May 2026. Two critical code-execution flaws resolved; accessibility improved
In short
The update resolves 9 vulnerabilities, including two critical remote-code-execution flaws, and fixes accessibility and page-loading problems. Updates for this server version end July 14, 2026.
Does it affect you? Applies to: Organizations running the release version of SharePoint Server 2019. This update builds the server to 16.0.10417.20128.
Microsoft ships this release as two packages: KB5002870, the update itself, and KB5002872 for the language packs. Install both on every server of the farm, then run the SharePoint Products Configuration Wizard.
What changes
Fixes 5 changes
Microsoft Word
- A remote-code-execution vulnerability in Microsoft Word is resolved.1
SharePoint Server
- A remote-code-execution vulnerability in SharePoint Server is resolved.1
Accessibility
2 items
-
Decorative images are marked so screen readers ignore them instead of announcing them as graphics.2
Corrects missing alternative text or an appropriate role on decorative images.
-
Text and background colors meet the minimum contrast ratio for WCAG 2.0 AA.3
Adjusts foreground and background color contrast to meet the specified thresholds.
Pages
-
Pages blocked because user controls are flagged as unsafe can load after those controls are explicitly trusted.4
Configure the custom farm property
AllowedTagPrefixesWhichAreNotWebControlsListto trust the affected controls.
Technical details
Data sheet · Security · Downloads · Components Click to collapse or expand
Data sheet
- Released
- 2026-05-12
- Classification
- Security Updates
- Type
- Cumulative update
- Restart
- Required
- Replaces
- KB5002854, KB5002845, KB5002834, KB5002825
- Replaced by
- KB5002874
| Version | Build | Channel |
|---|---|---|
| 2019 | 16.0.10417.20128 | General availability |
Security
| Vulnerability | Severity | CVSS |
|---|---|---|
|
Microsoft SharePoint Server Remote Code Execution Vulnerability
|
Critical | 8.8 |
|
Microsoft Word Remote Code Execution Vulnerability
|
Critical | 8.4 |
|
Microsoft SharePoint Server Remote Code Execution Vulnerability
|
Important | 8.8 |
|
Microsoft SharePoint Server Remote Code Execution Vulnerability
|
Important | 8.8 |
|
Microsoft SharePoint Server Remote Code Execution Vulnerability
|
Important | 8.8 |
|
Microsoft SharePoint Server Remote Code Execution Vulnerability
|
Important | 8.8 |
|
Microsoft SharePoint Remote Code Execution Vulnerability
|
Important | 8.8 |
|
Microsoft SharePoint Server Remote Code Execution Vulnerability
|
Important | 8.0 |
|
Microsoft SharePoint Server Remote Code Execution Vulnerability
|
Important | 8.0 |
Downloads (Microsoft Update Catalog)
Package
2019
0.9 GB
Language packs (50)
- Arabic (Saudi Arabia)
- Azerbaijani (Latin, Azerbaijan)
- Basque (Spain)
- Bosnian (Latin, Bosnia & Herzegovina)
- Bulgarian (Bulgaria)
- Catalan (Spain)
- Chinese (China)
- Chinese (Taiwan)
- Croatian (Croatia)
- Czech (Czechia)
- Danish (Denmark)
- Dari (Afghanistan)
- Dutch (Netherlands)
- English (United States)
- Estonian (Estonia)
- Finnish (Finland)
- French (France)
- Galician (Spain)
- German (Germany)
- Greek (Greece)
- Hebrew (Israel)
- Hindi (India)
- Hungarian (Hungary)
- Indonesian (Indonesia)
- Irish (Ireland)
- Italian (Italy)
- Japanese (Japan)
- Kazakh (Kazakhstan)
- Korean (South Korea)
- Latvian (Latvia)
- Lithuanian (Lithuania)
- Macedonian (North Macedonia)
- Malay (Malaysia)
- Norwegian Bokmål (Norway)
- Polish (Poland)
- Portuguese (Brazil)
- Portuguese (Portugal)
- Romanian (Romania)
- Russian (Russia)
- Serbian (Cyrillic, Serbia)
- Serbian (Latin, Serbia)
- Slovak (Slovakia)
- Slovenian (Slovenia)
- Spanish (Spain)
- Swedish (Sweden)
- Thai (Thailand)
- Turkish (Türkiye)
- Ukrainian (Ukraine)
- Vietnamese (Vietnam)
- Welsh (United Kingdom)
Package
2019
445.6 MB
Updated components
452 files changed since the previous update for the same versions.
| Top changed components | Files |
|---|---|
| Search | 44 |
| Project Server | 23 |
| Document conversion | 20 |
| Client object model | 9 |
| Access Services | 8 |
| Document management and policies | 6 |
| Managed metadata | 5 |
| Office web apps | 3 |
| PowerPoint | 3 |
| PowerShell | 2 |
| Publishing | 2 |
| Translation Services | 2 |
Sources
Updated
Cited passages from Microsoft's official notes (4)
-
1.
This security update resolves a Microsoft Word Remote Code Execution vulnerability and Microsoft SharePoint Server Remote Code Execution vulnerability.
support.microsoft.com -
2.
Fixes an issue in which decorative images lack alternative text or an appropriate role, causing screen readers to announce them as “graphic.”
support.microsoft.com -
3.
Fixes an issue in which the contrast between foreground and background colors doesn't meet WCAG 2.0 AA minimum contrast ratio thresholds.
support.microsoft.com -
4.
Resolves an issue in which pages don't load because certain user controls are flagged as unsafe. After you apply this fix, you can explicitly trust the affected controls by configuring the appropriate custom farm property, (
support.microsoft.comAllowedTagPrefixesWhichAreNotWebControlsList).
Checked automatically: 7 of 8 checks passed, 4 quoted passages · compared with Microsoft's page on Sep 26, 2026
- Quotes found in the official pages: passed
- Numbers found in the sources: passed
- Vulnerabilities from the dossier only: passed
- Links to allowed domains only: passed
- Every official change covered: passed
- Readable plain text: passed
- Changes confirmed by the file list: passed
- Sources agree: not passed
A second AI read the text against the sources: correctness 4/5, clarity 5/5, completeness 5/5. How we work
Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake