Skip to the content
The Update Bureau
SharePoint Server SE SharePoint Server SE Security update
Patch Tuesday

KB5002893

KB5002893: Cumulative update for SharePoint Server, version SE, August 2026. Critical privilege and code-execution flaws patched; workflow changes ahead

In short

Critical flaws include privilege escalation and remote code execution risks. The update also fixes broken cache and workflow links.

Does it affect you? Applies to: SharePoint Server Subscription Edition farms running the release version. The update package is for x64 systems.

Build
16.0.19725.20522
Security
30 fixed · 3 critical
Restart
Required

What changes

Improvements 6 changes

ExecuteProxyUpdates

For: SharePoint farm administrators

  • The ExecuteProxyUpdates feature will be disabled starting with the September 2026 Cumulative Update.1
    To enable it for a site collection, use Enable-SPWebPartPagesProxyUpdates. To disable it immediately, use Disable-SPWebPartPagesProxyUpdates.

Remote Event Receivers (RERs)

For: SharePoint farm administrators

  • Orphaned Remote Event Receivers without an app identifier will be blocked starting with the November 2026 Public Update.2
    Use Get-SPOrphanedRemoteEventReceiver to identify affected RERs.

OWA web part Exchange autodiscovery

For: SharePoint farm administrators

  • OWA web part Exchange autodiscovery will be disabled starting with the August 2026 Public Update.3
    Use Enable-SPOWAWebPartAutodiscovery to enable the feature for a web application.

SharePoint 2010 Workflow

Verified in package

For: SharePoint farm administrators

  • The SharePoint 2010 Workflow feature will be disabled starting with the September 2026 Public Update.4
    Use Enable-SPLegacyWorkflow to enable the feature for a site collection.

ToolPane

For: SharePoint farm administrators

  • The ToolPane feature will be disabled starting with the September 2026 Public Update.5
    Use Enable-SPToolPane to enable ToolPane for a site collection.

Business Data Connectivity (BDC)

Verified in package

For: SharePoint farm administrators

  • File-backed Business Data Connectivity model imports are disabled by default to improve security.6
    Use the Enable-BdcmFileImport PowerShell cmdlet to enable this functionality for a site collection.

Fixes 2 changes

Distributed Cache (DCache)

For: SharePoint farm administrators

  • Distributed Cache works again after the July 2026 Public Update.7
    Fixes an issue in which Distributed Cache (DCache) does not work after the July 2026 Public Update is installed.

Workflow status links

Verified in package

For: SharePoint farm administrators

  • Workflow status links work again on the WrkStat.aspx page.8
    Fixes broken workflow status links on WrkStat.aspx.

New feature 1 change

SharePoint 2013 workflows

For: SharePoint farm administrators

  • The update adds an advisory for SharePoint 2013 workflows.9

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2026-08-11
Classification
Security Updates
Type
Cumulative update
Restart
Required
Replaces
KB5002882, KB5002873, KB5002863, KB5002853
+25 earlier KB5002843, KB5002833, KB5002822, KB5002815, KB5002800, KB5002786, KB5002784, KB5002773, KB5002768, KB5002751, KB5002736, KB5002709, KB5002705, KB5002681, KB5002676, KB5002658, KB5002651, KB5002649, KB5002640, KB5002606, KB5002603, KB5002599, KB5002581, KB5002564, KB5002540
Replaced by
KB5002908
VersionBuildChannel
SE 16.0.19725.20522 General availability

Security

30 vulnerabilities fixed
3 critical 26 important 1 not rated
VulnerabilitySeverityCVSS
CVE-2026-62827
Microsoft SharePoint Server Elevation of Privilege Vulnerability
 Critical 8.8
CVE-2026-64921
Microsoft SharePoint Server Elevation of Privilege Vulnerability
 Critical 8.8
CVE-2026-65665
Microsoft SharePoint Server Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-70306
Microsoft Office SharePoint Spoofing Vulnerability
 Important 9.3
CVE-2026-63514
Microsoft SharePoint Server Remote Code Execution Vulnerability
 Important 8.8
CVE-2026-64901
Microsoft SharePoint Server Remote Code Execution Vulnerability
 Important 8.8
CVE-2026-65658
Microsoft SharePoint Server Remote Code Execution Vulnerability
 Important 8.8
CVE-2026-65660
Microsoft SharePoint Server Remote Code Execution Vulnerability
 Important 8.8
CVE-2026-65663
Microsoft SharePoint Server Remote Code Execution Vulnerability
 Important 8.8
CVE-2026-66808
Microsoft SharePoint Server Remote Code Execution Vulnerability
 Important 8.8
CVE-2026-70321
Microsoft SharePoint Remote Code Execution Vulnerability
 Important 8.8
CVE-2026-70324
Microsoft SharePoint Elevation of Privilege Vulnerability
 Important 8.8
CVE-2026-70326
Microsoft SharePoint Server Elevation of Privilege Vulnerability
 Important 8.8
CVE-2026-63520
Microsoft SharePoint Server Remote Code Execution Vulnerability
 Important 8.1
CVE-2026-57105
Microsoft Office SharePoint Spoofing Vulnerability
 Important 8.0
CVE-2026-64900
Microsoft SharePoint Server Spoofing Vulnerability
 Important 7.3
CVE-2026-70355
Microsoft SharePoint Server Elevation of Privilege Vulnerability
 Important 7.3
CVE-2026-97782
Microsoft Office SharePoint Tampering Vulnerability
 Important 6.8
CVE-2026-58639
Microsoft SharePoint Server Spoofing Vulnerability
 Important 6.5
CVE-2026-62837
Microsoft SharePoint Server Information Disclosure Vulnerability
 Important 6.5
CVE-2026-62839
Microsoft SharePoint Server Spoofing Vulnerability
 Important 6.5
CVE-2026-63512
Microsoft SharePoint Server Tampering Vulnerability
 Important 6.5
CVE-2026-63516
Microsoft SharePoint Server Spoofing Vulnerability
 Important 6.5
CVE-2026-62829
Microsoft SharePoint Server Spoofing Vulnerability
 Important 4.6
CVE-2026-62917
Microsoft SharePoint Server Spoofing Vulnerability
 Important 4.6
CVE-2026-64897
Microsoft SharePoint Server Spoofing Vulnerability
 Important 4.6
CVE-2026-64902
Microsoft SharePoint Server Spoofing Vulnerability
 Important 4.6
CVE-2026-64916
Microsoft SharePoint Server Spoofing Vulnerability
 Important 4.6
CVE-2026-64922
Microsoft SharePoint Server Spoofing Vulnerability
 Important 4.6
CVE-2026-66805
Microsoft SharePoint Server Remote Code Execution Vulnerability
 Not rated —

Updated components

1,037 files changed since the previous update for the same versions.

Top changed componentsFiles
Search202
Document conversion100
Client object model53
Project Server33
Document management and policies11
Office web apps8
Managed metadata6
PowerPoint6
PowerShell4
Translation Services3
Workflow3
Publishing2

Verified in package: changed files confirm SharePoint 2010 Workflow, Business Data Connectivity (BDC), Workflow status links.

Page history

  1. Added CVE-2026-97782 (Important)

Sources

Updated
Cited passages from Microsoft's official notes (9)
  1. 1. Notifies that the ExecuteProxyUpdates feature will be disabled starting in the September 2026 Cumulative Update. support.microsoft.com
  2. 2. Notifies that orphaned Remote Event Receivers (RERs) that do not have an app identifier will be blocked starting with the November 2026 Public Update. support.microsoft.com
  3. 3. Notifies that OWA web part Exchange autodiscovery will be disabled starting with the August 2026 Public Update. support.microsoft.com
  4. 4. Notifies that the SharePoint 2010 Workflow feature will be disabled starting with the September 2026 Public Update. support.microsoft.com
  5. 5. Notifies that the ToolPane feature will be disabled starting with the September 2026 Public Update. support.microsoft.com
  6. 6. Disables file-backed Business Data Connectivity (BDC) model import by default to improve security. support.microsoft.com
  7. 7. Fixes an issue in which Distributed Cache (DCache) does not work after the July 2026 Public Update is installed. support.microsoft.com
  8. 8. Fixes an issue in which workflow status links break on the WrkStat.aspx page. support.microsoft.com
  9. 9. Adds an advisory for SharePoint 2013 workflows. support.microsoft.com
Checked automatically: 7 of 8 checks passed, 9 quoted passages · compared with Microsoft's page on Oct 16, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: not passed

A second AI read the text against the sources: correctness 5/5, clarity 4/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake