Skip to the content
The Update Bureau
SharePoint Server 2016 SharePoint Server 2016 Security update
Patch Tuesday Zero-day

KB5002891

KB5002891: Cumulative update for SharePoint Server, version 2016, July 2026. Exploited privilege flaw patched; final update for this version

In short

Attackers are exploiting a SharePoint Server privilege flaw. This is the final update for this version and includes fixes for critical security vulnerabilities.

Does it affect you? Applies to: SharePoint Server 2016 devices with the release version installed; the package is for x64. This is the final update for all editions.

Build
16.0.5561.1001
Security
40 fixed · 6 critical · 1 exploited
Restart
Required
Review notes Additional details from the official release notes (3) Read notes
  • This page The dossier lists July 14, 2026 as the end-of-updates date for all SharePoint Server 2016 editions, but does not identify KB5002891 as the final update.
  • In detail The dossier lists July 14, 2026 as the end-of-updates date for all SharePoint Server 2016 editions, but does not identify KB5002891 as the final update.
  • Does it affect you? The dossier lists July 14, 2026 as the end-of-updates date for all SharePoint Server 2016 editions, but does not identify KB5002891 as the final update.

The official sources are linked at the end of the page.

Microsoft ships this release as two packages: KB5002891, the update itself, and KB5002892 for the language packs. Install both on every server of the farm, then run the SharePoint Products Configuration Wizard.

What changes

New features 6 changes

SharePoint Framework (SPFx)

For: SharePoint Server users and administrators

  • SharePoint Framework is included in Feature Pack 2.1
    This public update delivers Feature Pack 2 for SharePoint Server 2016.

Administrative Actions Logging

  • Feature Pack 1 includes Administrative Actions Logging.2

SharePoint Custom Tiles

  • Feature Pack 1 includes SharePoint Custom Tiles.3

Hybrid Taxonomy

For: SharePoint Server users and administrators

  • Feature Pack 1 includes Hybrid Taxonomy.4

OneDrive API for SharePoint on-premises

For: SharePoint Server developers and administrators

  • Feature Pack 1 includes the OneDrive API for SharePoint on-premises.5

OneDrive for Business modern user experience

  • The OneDrive for Business modern experience is available to Software Assurance customers.6
    An active Software Assurance contract is required when the experience is enabled, either through this update or manual enablement. Without one, turn off the experience.

Fix 1 change

SharePoint 2010 workflows

For: SharePoint Server users and administrators

  • SharePoint 2010 workflows start again after the June 2026 update.7
    Resolves an issue that stopped SharePoint 2010 workflows from initiating after the June 2026 update.

Improvement 1 change

MinRole enhancements

  • Feature Pack 1 includes MinRole enhancements.8

Known issues

  1. Open Affects: Organizations and IT administrators

    Customers in multi-front-end SharePoint farms with Trusted Provider or Forms authentication may face repeated authentication prompts or multiple sign-ins.

    Multi-front-end farms using Trusted Provider or Forms authentication might show repeated sign-in prompts. Farms using Windows authentication should not be affected.9

    How to apply the workaround Workaround

    Configure sticky sessions on the reverse proxy; this addresses most reported scenarios.9

  2. Open Affects: Organizations and IT administrators

    When a workflow status link is selected, WrkStat.aspx displays the following error message: The WorkflowInstanceID parameter is invalid.

    Selecting a workflow status link can make WrkStat.aspx show “The WorkflowInstanceID parameter is invalid.”10

    How to apply the workaround Workaround

    Follow Microsoft's linked guidance for workflow status links.10

  3. Open Affects: Organizations and IT administrators

    Customers who install the SharePoint 2016 July Public Update might find that Office Online Server can't render or edit documents.

    After installing the July public update, Office Online Server might not render or edit documents.11

    How to apply the workaround SharePoint Management Shell

    The workaround trusts the farm's public signing certificate so Office Online Server can render and edit documents.11

    Step-by-step instructions, command & download kit
    4 steps SharePoint Management Shell Instructions (.txt)
    Show steps & kit Hide steps & kit
    Step-by-step procedure
    1. Get the STS signing certificate and export its public certificate to STS_Public.cer.
    2. Check that $pub.HasPrivateKey returns False.
    3. Register the public certificate as a trusted token issuer.
    4. Run iisreset on every SharePoint server in the farm.
    SharePoint Management Shell 
    > $stsm = Get-SPSecurityTokenServiceConfig> $live = $stsm.LocalLoginProvider.SigningCertificate> $bytes = $live.Export("Cert")> $tempFile = "$env:TEMP\STS_Public.cer"> Set-Content -Path $tempFile -Value $bytes -Encoding Byte> $pub = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2($tempFile)> $pub.HasPrivateKey> $realm = $stsm.NameIdentifier> New-SPTrustedSecurityTokenIssuer `
        -Name "LocalSelfIssuerWopiFix" `
        -Description "Re-trust farm self-issuer after July PU" `
        -Certificate $pub `
        -RegisteredIssuerName $realm> iisreset

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2026-07-14
Classification
Security Updates
Type
Cumulative update
Restart
Required
Replaces
KB5002880, KB5002861, KB5002850, KB5002841
+8 earlier KB5002828, KB5002821, KB5002805, KB5002788, KB5002778, KB5002771, KB5002760, KB5002744
Replaced by
KB5002905
VersionBuildChannel
2016 16.0.5561.1001 General availability

Security

40 vulnerabilities fixed
1 exploited 6 critical 33 important 1 moderate
VulnerabilitySeverityCVSS
CVE-2026-56164 Exploited
Microsoft SharePoint Server Elevation of Privilege Vulnerability
 Moderate 5.3
CVE-2026-50522
Microsoft SharePoint Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-55040
Microsoft SharePoint Server Security Feature Bypass Vulnerability
 Critical 9.1
CVE-2026-55045
Microsoft Office Remote Code Execution Vulnerability
 Critical 8.4
CVE-2026-55033
Microsoft Word Remote Code Execution Vulnerability
 Critical 7.8
CVE-2026-55127
Microsoft Word Remote Code Execution Vulnerability
 Critical 7.8
CVE-2026-55132
Microsoft Word Remote Code Execution Vulnerability
 Critical 7.8

The table lists the 7 exploited, publicly disclosed or critical vulnerabilities. See all 40 vulnerabilities →

Page history

  1. Added CVE-2026-97783 (Important)

Sources

Updated
Cited passages from Microsoft's official notes (11)
  1. 1. SharePoint Framework (SPFx) support.microsoft.com
  2. 2. Administrative Actions Logging support.microsoft.com
  3. 3. SharePoint Custom Tiles support.microsoft.com
  4. 4. Hybrid Taxonomy support.microsoft.com
  5. 5. OneDrive API for SharePoint on-premises support.microsoft.com
  6. 6. OneDrive for Business modern user experience (available to Software Assurance customers) support.microsoft.com
  7. 7. This update resolves an issue in which SharePoint 2010 workflows don't initiate after the June 2026 update is installed. support.microsoft.com
  8. 8. MinRole enhancements support.microsoft.com
  9. 9. Customers in multi-front-end SharePoint farms with Trusted Provider or Forms authentication may face repeated authentication prompts or multiple sign-ins. support.microsoft.com
  10. 10. When a workflow status link is selected, WrkStat.aspx displays the following error message: support.microsoft.com
  11. 11. To mitigate this problem, register the farm's STS signing certificate (public key only) as a trusted token issuer, and then recycle IIS on every server in the farm by using the following steps: support.microsoft.com
Checked automatically: 7 of 8 checks passed, 11 quoted passages · compared with Microsoft's page on Sep 26, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: not passed

A second AI read the text against the sources: correctness 3/5, clarity 4/5, completeness 4/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake