Skip to the content
The Update Bureau
SharePoint Server 2019 SharePoint Server 2019 Security update
Patch Tuesday Final update for this version

KB5002894

KB5002894: Cumulative update for SharePoint Server, version 2019, August 2026. Remote-code execution and privilege-escalation risks addressed

In short

The update addresses 27 vulnerabilities, including three critical SharePoint Server flaws involving remote-code execution and privilege escalation. It also fixes broken workflow status links and changes several SharePoint features.

Does it affect you? Applies to: SharePoint Server 2019 farms with the release version installed. The update package is for x64 systems.

Build
16.0.10417.20198
Security
27 fixed · 3 critical
Restart
Required
Review notes Additional details from the official release notes (1) Read note
  • What to do For Classic Workflow Manager, enable the debug flag to continue using Workflow Manager. The page does not specify that this must be done before installing the update.

The official sources are linked at the end of the page.

Microsoft ships this release as two packages: KB5002894, the update itself, and KB5002896 for the language packs. Install both on every server of the farm, then run the SharePoint Products Configuration Wizard.

What changes

Improvements 7 changes

SharePoint 2013 workflows

  • An advisory is provided for SharePoint 2013 workflows.1

Remote Event Receivers

  • Orphaned Remote Event Receivers without an app identifier might be blocked in the future.2
    Use Get-SPOrphanedRemoteEventReceiver to identify affected receivers.

ToolPane

  • The ToolPane feature might be disabled in the future.3
    Use Enable-SPToolPane to enable ToolPane for a site collection.

ExecuteProxyUpdates

  • The ExecuteProxyUpdates feature might be disabled in the future.4
    Use Enable-SPWebPartPagesProxyUpdates to enable the feature for a site collection, or Disable-SPWebPartPagesProxyUpdates to disable it immediately.

OWA web part

  • Exchange autodiscovery for the OWA web part is disabled starting with the August 2026 Public Update.5
    Use Enable-SPOWAWebPartAutodiscovery to enable the feature for a web application.

SharePoint 2010 Workflow

Verified in package
  • The SharePoint 2010 Workflow feature might be disabled in the future.6
    Use Enable-SPLegacyWorkflow to enable the feature for a site collection.

Business Data Connectivity

  • File-backed Business Data Connectivity model imports are disabled by default to improve security.7
    Use Enable-BdcmFileImport to enable this functionality for a site collection.

Fix 1 change

Workflow status links

Verified in package
  • Workflow status links on the WrkStat.aspx page work again.8
    Fixes broken workflow status links on WrkStat.aspx.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2026-08-11
Classification
Security Updates
Type
Cumulative update
Restart
Required
Replaces
KB5002883, KB5002874, KB5002870, KB5002854
+10 earlier KB5002845, KB5002834, KB5002825, KB5002816, KB5002803, KB5002796, KB5002775, KB5002769, KB5002754, KB5002741
VersionBuildChannel
2019 16.0.10417.20198 General availability

Security

27 vulnerabilities fixed
3 critical 24 important
VulnerabilitySeverityCVSS
CVE-2026-62827
Microsoft SharePoint Server Elevation of Privilege Vulnerability
 Critical 8.8
CVE-2026-64921
Microsoft SharePoint Server Elevation of Privilege Vulnerability
 Critical 8.8
CVE-2026-65665
Microsoft SharePoint Server Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-70306
Microsoft Office SharePoint Spoofing Vulnerability
 Important 9.3
CVE-2026-63514
Microsoft SharePoint Server Remote Code Execution Vulnerability
 Important 8.8
CVE-2026-64901
Microsoft SharePoint Server Remote Code Execution Vulnerability
 Important 8.8
CVE-2026-65658
Microsoft SharePoint Server Remote Code Execution Vulnerability
 Important 8.8
CVE-2026-65660
Microsoft SharePoint Server Remote Code Execution Vulnerability
 Important 8.8
CVE-2026-65663
Microsoft SharePoint Server Remote Code Execution Vulnerability
 Important 8.8
CVE-2026-66805
Microsoft SharePoint Server Remote Code Execution Vulnerability
 Important 8.8
CVE-2026-66808
Microsoft SharePoint Server Remote Code Execution Vulnerability
 Important 8.8
CVE-2026-70324
Microsoft SharePoint Elevation of Privilege Vulnerability
 Important 8.8
CVE-2026-63520
Microsoft SharePoint Server Remote Code Execution Vulnerability
 Important 8.1
CVE-2026-57105
Microsoft Office SharePoint Spoofing Vulnerability
 Important 8.0
CVE-2026-64900
Microsoft SharePoint Server Spoofing Vulnerability
 Important 7.3
CVE-2026-70355
Microsoft SharePoint Server Elevation of Privilege Vulnerability
 Important 7.3
CVE-2026-58639
Microsoft SharePoint Server Spoofing Vulnerability
 Important 6.5
CVE-2026-62837
Microsoft SharePoint Server Information Disclosure Vulnerability
 Important 6.5
CVE-2026-62839
Microsoft SharePoint Server Spoofing Vulnerability
 Important 6.5
CVE-2026-63512
Microsoft SharePoint Server Tampering Vulnerability
 Important 6.5
CVE-2026-63516
Microsoft SharePoint Server Spoofing Vulnerability
 Important 6.5
CVE-2026-62829
Microsoft SharePoint Server Spoofing Vulnerability
 Important 4.6
CVE-2026-62917
Microsoft SharePoint Server Spoofing Vulnerability
 Important 4.6
CVE-2026-64897
Microsoft SharePoint Server Spoofing Vulnerability
 Important 4.6
CVE-2026-64902
Microsoft SharePoint Server Spoofing Vulnerability
 Important 4.6
CVE-2026-64916
Microsoft SharePoint Server Spoofing Vulnerability
 Important 4.6
CVE-2026-64922
Microsoft SharePoint Server Spoofing Vulnerability
 Important 4.6

Updated components

660 files changed since the previous update for the same versions.

Top changed componentsFiles
Search44
Project Server23
Document conversion20
Client object model9
Access Services8
Document management and policies6
Managed metadata5
Office web apps3
PowerPoint3
PowerShell2
Publishing2
Translation Services2

Verified in package: changed files confirm SharePoint 2010 Workflow, Workflow status links.

Page history

  1. Added CVE-2026-66805 (Important)

Sources

Updated
Cited passages from Microsoft's official notes (8)
  1. 1. Provides an advisory for SharePoint 2013 workflows. support.microsoft.com
  2. 2. Notifies that orphaned Remote Event Receivers (RERs) that don't have an app identifier might be blocked in the future. support.microsoft.com
  3. 3. Notifies that the ToolPane feature might be disabled in the future. support.microsoft.com
  4. 4. Notifies that the ExecuteProxyUpdates feature might be disabled in the future. support.microsoft.com
  5. 5. Notifies that OWA web part Exchange autodiscovery will be disabled starting with the August 2026 Public Update. support.microsoft.com
  6. 6. Notifies that the SharePoint 2010 Workflow feature might be disabled in the future. support.microsoft.com
  7. 7. Disables file-backed Business Data Connectivity (BDC) model import by default to improve security. support.microsoft.com
  8. 8. Fixes an issue in which workflow status links break on the WrkStat.aspx page. support.microsoft.com
Checked automatically: 7 of 8 checks passed, 8 quoted passages · compared with Microsoft's page on Sep 26, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: not passed

A second AI read the text against the sources: correctness 4/5, clarity 4/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake