Skip to the content
The Update Bureau
SharePoint Server 2019 SharePoint Server 2019 Security update
Patch Tuesday Zero-day

KB5002874

KB5002874: Cumulative update for SharePoint Server, version 2019, June 2026. Actively exploited remote-code flaw patched; 2019 updates end July 14

In short

Fixes security vulnerabilities in SharePoint Server 2019, including an actively exploited remote-code flaw. Updates for this version end July 14, 2026.

Does it affect you? Applies to: SharePoint Server 2019 farms running the release version; the update package is x64. Updates for all editions end July 14, 2026.

Build
16.0.10417.20153
Security
32 fixed · 3 critical · 1 exploited
Restart
Required

Microsoft ships this release as two packages: KB5002874, the update itself, and KB5002876 for the language packs. Install both on every server of the farm, then run the SharePoint Products Configuration Wizard.

What changes

Fix 1 change

Security

For: SharePoint farm administrators

  • The update resolves vulnerabilities that could allow remote code execution, spoofing, elevation of privilege, or information disclosure.1
    Includes CVE-2026-58644, a SharePoint remote code execution vulnerability.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2026-06-09
Classification
Security Updates
Type
Cumulative update
Restart
Required
Replaces
KB5002870, KB5002854, KB5002845, KB5002834
+8 earlier KB5002825, KB5002816, KB5002803, KB5002796, KB5002775, KB5002769, KB5002754, KB5002741
Replaced by
KB5002883
VersionBuildChannel
2019 16.0.10417.20153 General availability

Security

32 vulnerabilities fixed
1 exploited 3 critical 28 important 1 not rated
VulnerabilitySeverityCVSS
CVE-2026-58644 Exploited
Microsoft SharePoint Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-45456
Microsoft Outlook and Word Remote Code Execution Vulnerability
 Critical 8.4
CVE-2026-45458
Microsoft Outlook and Word Remote Code Execution Vulnerability
 Critical 8.4

The table lists the 3 exploited, publicly disclosed or critical vulnerabilities. See all 32 vulnerabilities →

Updated components

474 files changed since the previous update for the same versions.

Top changed componentsFiles
Search44
Project Server23
Document conversion20
Client object model9
Access Services8
Document management and policies6
Managed metadata5
Office web apps3
PowerPoint3
PowerShell2
Publishing2
Translation Services2

Sources

Updated
Cited passages from Microsoft's official notes (1)
  1. 1. This security update resolves a Microsoft Word Remote Code Execution vulnerability, Microsoft SharePoint Server Spoofing vulnerability, Microsoft SharePoint Elevation of Privilege vulnerability, and Microsoft Word Information Disclosure vulnerability. support.microsoft.com
Checked automatically: 7 of 8 checks passed, 1 quoted passage · compared with Microsoft's page on Sep 26, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: not passed

A second AI read the text against the sources: correctness 4/5, clarity 5/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake