KB5002882: Cumulative update for SharePoint Server, version SE, July 2026. Exploited elevation flaw patched; legacy workflows start again

An exploited elevation-of-privilege flaw is patched, and SharePoint 2010 workflows that failed to start after June's update work again.

Does it affect you? Applies to: SharePoint Server Subscription Edition farms with the release version installed. The package is for x64 systems.

Review notes Additional details from the official release notes (3) Read notes

What to do After PSConfig, run the commands that set DisableActorTokenAudienceValidation to $true and update the farm. The iisreset command is part of the separate Classic Workflow Manager instructions.
Known issues Microsoft does not recommend disabling SessionCookieTransformProtectionEnabled; turning it off can expose the farm to security vulnerabilities.
Known issues The official page lists the PowerShell commands to run after PSConfig but does not specify that they must be run in an elevated PowerShell window.

The official sources are linked at the end of the page.

What changes

Fix 1 change

SharePoint 2010 workflows

SharePoint 2010 workflows that stopped starting after the June 2026 update can start again.¹
Fixes the issue that prevented SharePoint 2010 workflows from initiating after the June 2026 update.

Known issues

Open Affects: Organizations and IT administrators

Customers in multi-front-end SharePoint farms with Trusted Provider or Forms authentication may face repeated authentication prompts or multiple sign-ins.

Some multi-front-end farms using Trusted Provider or Forms authentication might show repeated sign-in prompts. Farms using Windows authentication are not affected.²

How to apply the workaround Workaround

Configure sticky sessions on the reverse proxy; this helps in most cases.²
Open Affects: Organizations and IT administrators

When a workflow status link is selected, WrkStat.aspx displays the following error message: The WorkflowInstanceID parameter is invalid.

Selecting a workflow status link can make WrkStat.aspx show an error that says the workflow ID is invalid.³

How to apply the workaround Workaround

Follow the linked guidance for workflow status links.³
Open Affects: Organizations and IT administrators

After you run PSConfig, run the following PowerShell commands.

After PSConfig, run the listed PowerShell commands to avoid a possible regression from a defense-in-depth feature under development.⁴

How to apply the workaround PowerShell

The setting disables the defense-in-depth check that may cause a regression. Existing actor token validation checks remain in place.⁴
Step-by-step instructions, command & download kit
1 step powershell.exe · Administrator Instructions (.txt)

Show steps & kit Hide steps & kit
Step-by-step procedure
1. After running PSConfig, run the three PowerShell commands.
powershell.exe · Administrator

> $farm = Get-SPFarm> $farm. DisableActorTokenAudienceValidation = $true #disables only the defense-in-depth validation> $farm.update ()

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released: 2026-07-14
Classification: Security Updates
Type: Cumulative update
Restart: Required
Replaces: KB5002873, KB5002863, KB5002853, KB5002843

+24 earlier
KB5002833, KB5002822, KB5002815, KB5002800, KB5002786, KB5002784, KB5002773, KB5002768, KB5002751, KB5002736, KB5002709, KB5002705, KB5002681, KB5002676, KB5002658, KB5002651, KB5002649, KB5002640, KB5002606, KB5002603, KB5002599, KB5002581, KB5002564, KB5002540
Replaced by: KB5002893

Version	Build	Channel
SE	16.0.19725.20434	General availability

Security

39 vulnerabilities fixed

1 exploited 6 critical 32 important 1 moderate

Vulnerability	Severity	CVSS
CVE-2026-56164 Exploited Microsoft SharePoint Server Elevation of Privilege Vulnerability	Moderate	5.3
CVE-2026-50522 Microsoft SharePoint Remote Code Execution Vulnerability	Critical	9.8
CVE-2026-55040 Microsoft SharePoint Server Security Feature Bypass Vulnerability	Critical	9.1
CVE-2026-55045 Microsoft Office Remote Code Execution Vulnerability	Critical	8.4
CVE-2026-55033 Microsoft Word Remote Code Execution Vulnerability	Critical	7.8
CVE-2026-55127 Microsoft Word Remote Code Execution Vulnerability	Critical	7.8
CVE-2026-55132 Microsoft Word Remote Code Execution Vulnerability	Critical	7.8

The table lists the 7 exploited, publicly disclosed or critical vulnerabilities. See all 39 vulnerabilities →

Downloads (Microsoft Update Catalog)

Package SE

1.6 GB

sts-x-none.cab Main update · KB5002882 SHA-1: 4b58752b…329efd

Language packs (49)

Updated components

1,164 files changed since the previous update for the same versions.

Top changed components	Files
Search	202
Document conversion	100
Client object model	53
Project Server	33
Document management and policies	11
Office web apps	8
Managed metadata	6
PowerPoint	6
PowerShell	4
Translation Services	3
Workflow	3
Publishing	2

Page history

Nov 9, 2026

Added CVE-2026-97783 (Important)

Sources

Microsoft Support: KB5002882

Updated Nov 9, 2026

Cited passages from Microsoft's official notes (4)

1. Fixes an issue in which SharePoint 2010 workflows don't initiate after the June 2026 update is installed. support.microsoft.com
2. As a mitigation, configuring sticky sessions on the reverse proxy will address the majority of scenarios. support.microsoft.com
3. To workaround this issue, see [Workflow status links fail after installing the July 2026 CU.] support.microsoft.com
4. This setting disables a defense-in-depth feature that is currently under development that may cause a regression. Existing actor token validation checks remain in place. support.microsoft.com

Checked automatically: 7 of 8 checks passed, 4 quoted passages · compared with Microsoft's page on Sep 26, 2026

Quotes found in the official pages: passed
Numbers found in the sources: passed
Vulnerabilities from the dossier only: passed
Links to allowed domains only: passed
Every official change covered: passed
Readable plain text: passed
Changes confirmed by the file list: passed
Sources agree: not passed

A second AI read the text against the sources: correctness 3/5, clarity 3/5, completeness 4/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake