Skip to the content
The Update Bureau
SharePoint Server 2016 SharePoint Server 2016 Security update
Patch Tuesday Zero-day

KB5002880

KB5002880: Cumulative update for SharePoint Server, version 2016, June 2026. Actively exploited remote-code flaw patched before support ends

In short

The update patches an actively exploited remote-code execution flaw and other vulnerabilities. SharePoint Server 2016 updates end on July 14, 2026.

Does it affect you? Applies to: SharePoint Server 2016 installations with the release version installed. The x64 update package brings the farm to build 16.0.5556.1005.

Build
16.0.5556.1005
Security
30 fixed · 3 critical · 1 exploited
Restart
Required

Microsoft ships this release as two packages: KB5002880, the update itself, and KB5002881 for the language packs. Install both on every server of the farm, then run the SharePoint Products Configuration Wizard.

What changes

New features 7 changes

SharePoint Framework

For: SharePoint administrators and developers

  • Feature Pack 2 delivers SharePoint Framework.1
    SharePoint Framework (SPFx) is included in Feature Pack 2.

Administrative Actions Logging

  • Feature Pack 1 includes Administrative Actions Logging.2

MinRole

  • Feature Pack 1 includes MinRole enhancements.3

SharePoint Custom Tiles

For: SharePoint users and administrators

  • Feature Pack 1 includes SharePoint Custom Tiles.4

Hybrid Taxonomy

  • Feature Pack 1 includes Hybrid Taxonomy.5

OneDrive API for SharePoint on-premises

For: SharePoint administrators and developers

  • Feature Pack 1 includes the OneDrive API for SharePoint on-premises.6

OneDrive for Business modern user experience

For: Software Assurance customers and SharePoint administrators

  • Feature Pack 1 includes the modern OneDrive for Business experience for customers with active Software Assurance when it is enabled. If you do not have an active contract at enablement, you must turn off the experience.7

Fixes 2 changes

Security

For: SharePoint Server 2016 administrators

  • The update resolves remote-code execution, information-disclosure, and spoofing vulnerabilities.8
    The vulnerability list includes CVE-2026-58644, a Microsoft SharePoint Remote Code Execution Vulnerability.

User controls

  • Pages can be configured to load when certain user controls were flagged as unsafe for security.9
    Customers can explicitly trust affected controls by configuring the custom farm property AllowedTagPrefixesWhichAreNotWebControlsList.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2026-06-09
Classification
Security Updates
Type
Cumulative update
Restart
Required
Replaces
KB5002861, KB5002850, KB5002841, KB5002828
+7 earlier KB5002821, KB5002805, KB5002788, KB5002778, KB5002771, KB5002760, KB5002744
Replaced by
KB5002891
VersionBuildChannel
2016 16.0.5556.1005 General availability

Security

30 vulnerabilities fixed
1 exploited 3 critical 27 important
VulnerabilitySeverityCVSS
CVE-2026-58644 Exploited
Microsoft SharePoint Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-45456
Microsoft Outlook and Word Remote Code Execution Vulnerability
 Critical 8.4
CVE-2026-45458
Microsoft Outlook and Word Remote Code Execution Vulnerability
 Critical 8.4
CVE-2026-45484
Microsoft SharePoint Elevation of Privilege Vulnerability
 Important 8.8
CVE-2026-47298
Microsoft SharePoint Server Remote Code Execution Vulnerability
 Important 8.0
CVE-2026-44819
Microsoft Office Remote Code Execution Vulnerability
 Important 7.8
CVE-2026-44824
Microsoft Office Remote Code Execution Vulnerability
 Important 7.8
CVE-2026-45471
Microsoft Word Remote Code Execution Vulnerability
 Important 7.8
CVE-2026-45475
Microsoft Office Remote Code Execution Vulnerability
 Important 7.8
CVE-2026-45481
Microsoft SharePoint Server Spoofing Vulnerability
 Important 7.3
CVE-2026-45454
Microsoft SharePoint Remote Code Execution Vulnerability
 Important 6.5
CVE-2026-44821
Microsoft Office Information Disclosure Vulnerability
 Important 5.5
CVE-2026-33113
Microsoft SharePoint Server Spoofing Vulnerability
 Important 5.4
CVE-2026-45453
Microsoft SharePoint Server Spoofing Vulnerability
 Important 5.4
CVE-2026-45464
Microsoft SharePoint Server Spoofing Vulnerability
 Important 5.4
CVE-2026-45465
Microsoft SharePoint Server Spoofing Vulnerability
 Important 5.4
CVE-2026-47636
Microsoft SharePoint Server Spoofing Vulnerability
 Important 5.4
CVE-2026-47639
Microsoft SharePoint Server Spoofing Vulnerability
 Important 5.4
CVE-2026-48560
Microsoft SharePoint Server Spoofing Vulnerability
 Important 5.4
CVE-2026-45462
Microsoft SharePoint Server Spoofing Vulnerability
 Important 4.6
CVE-2026-45467
Microsoft SharePoint Server Spoofing Vulnerability
 Important 4.6
CVE-2026-45468
Microsoft SharePoint Server Spoofing Vulnerability
 Important 4.6
CVE-2026-45479
Microsoft SharePoint Server Spoofing Vulnerability
 Important 4.6
CVE-2026-45483
Microsoft Office Project Server Spoofing Vulnerability
 Important 4.6
CVE-2026-47637
Microsoft SharePoint Server Spoofing Vulnerability
 Important 4.6
CVE-2026-47638
Microsoft SharePoint Server Spoofing Vulnerability
 Important 4.6
CVE-2026-47640
Microsoft SharePoint Server Spoofing Vulnerability
 Important 4.6
CVE-2026-47641
Microsoft SharePoint Server Spoofing Vulnerability
 Important 4.6
CVE-2026-48562
Microsoft SharePoint Server Spoofing Vulnerability
 Important 4.6
CVE-2026-45485
Microsoft Office Information Disclosure Vulnerability
 Important 3.3

Updated components

97 files changed since the previous update for the same versions.

Top changed componentsFiles
Client object model7
Document conversion7
Project Server4
Access Services1
Document management and policies1
PowerPoint1
Publishing1

Sources

Updated
Cited passages from Microsoft's official notes (9)
  1. 1. This public update delivers Feature Pack 2 for SharePoint Server 2016. Feature Pack 2 contains the following feature: support.microsoft.com
  2. 2. - Administrative Actions Logging support.microsoft.com
  3. 3. - MinRole enhancements support.microsoft.com
  4. 4. - SharePoint Custom Tiles support.microsoft.com
  5. 5. - Hybrid Taxonomy support.microsoft.com
  6. 6. - OneDrive API for SharePoint on-premises support.microsoft.com
  7. 7. The OneDrive for Business modern user experience requires an active Software Assurance contract at the time that the experience is enabled, either by installation of the public update or by manual enablement. support.microsoft.com
  8. 8. This security update resolves a Microsoft Word Remote Code Execution vulnerability, Microsoft Word Information Disclosure vulnerability, Microsoft SharePoint Server Spoofing Vulnerability. support.microsoft.com
  9. 9. This update fixes an issue in which pages don't load because certain user controls are flagged as unsafe for security. support.microsoft.com
Checked automatically: 7 of 8 checks passed, 9 quoted passages · compared with Microsoft's page on Sep 26, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: not passed

A second AI read the text against the sources: correctness 4/5, clarity 5/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake