Skip to the content
The Update Bureau
SharePoint Server 2016 SharePoint Server 2016 Security update
Patch Tuesday Final update for this version

KB5002905

KB5002905: Cumulative update for SharePoint Server, version 2016, August 2026. Two critical privilege flaws; workflow and cache fixes

In short

Fixes two critical SharePoint Server elevation-of-privilege vulnerabilities and resolves problems with workflow links, Distributed Cache, and Office Online Server document editing.

Does it affect you? Applies to: Organizations running the release version of SharePoint Server 2016. The update package is for x64 systems.

Build
16.0.5565.1001
Security
23 fixed · 2 critical
Restart
Required

Microsoft ships this release as two packages: KB5002905, the update itself, and KB5002906 for the language packs. Install both on every server of the farm, then run the SharePoint Products Configuration Wizard.

What changes

Improvements 8 changes

MinRole

  • MinRole enhancements are included with Feature Pack 1.1

SharePoint 2013 workflows

  • The update adds an advisory for SharePoint 2013 workflows.2

Remote Event Receivers

  • Orphaned Remote Event Receivers without an app identifier might be disabled in the future.2
    Use the Get-SPOrphanedRemoteEventReceiver cmdlet to identify affected Remote Event Receivers.

ToolPane

  • The ToolPane feature might be disabled in the future.2
    Use Enable-SPToolPane to enable ToolPane for a site collection.

ExecuteProxyUpdates

  • The ExecuteProxyUpdates feature might be disabled in the future.2
    Use Enable-SPWebPartPagesProxyUpdates to enable the feature for a site collection, or Disable-SPWebPartPagesProxyUpdates to disable it immediately.

OWA web part Exchange autodiscovery

  • OWA web part Exchange autodiscovery is disabled starting with the August 2026 Public Update. It can be enabled for a web application.2
    Use the Enable-SPOWAWebPartAutodiscovery cmdlet to enable the feature for a web application.

SharePoint 2010 Workflow

Verified in package
  • The SharePoint 2010 Workflow feature may be disabled in the future.2
    Use Enable-SPLegacyWorkflow to enable the feature for a site collection.

Business Data Connectivity

Verified in package
  • File-backed Business Data Connectivity model import is disabled by default to improve security.2
    Use the Enable-BdcmFileImport PowerShell cmdlet to enable this functionality for a site collection.

New features 6 changes

SharePoint Framework

  • SharePoint Framework is included with Feature Pack 2.3
    The update delivers Feature Pack 2 for SharePoint Server 2016.

Administrative Actions Logging

  • Administrative Actions Logging is included with Feature Pack 1.1

SharePoint Custom Tiles

  • SharePoint Custom Tiles are included with Feature Pack 1.1

Hybrid Taxonomy

  • Hybrid Taxonomy is included with Feature Pack 1.1

OneDrive API

  • The OneDrive API for SharePoint on-premises is included with Feature Pack 1.1

OneDrive for Business

For: Software Assurance customers

  • The OneDrive for Business modern user experience is included with Feature Pack 1 for organizations with an active Software Assurance contract when it is enabled.1
    If the contract is not active when the experience is enabled, the experience must be turned off.

Fixes 3 changes

Workflow

Verified in package
  • Workflow status links work on the WrkStat.aspx page again.4

Distributed Cache

  • Distributed Cache works again after installing the July 2026 Public Update.4
    The update fixes the issue in which Distributed Cache (DCache) did not work after the July 2026 Public Update.

Office Online Server

For: SharePoint and Office Online Server administrators

  • Office Online Server can render and edit documents again after the July 2026 Public Update.4

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2026-08-11
Classification
Security Updates
Type
Cumulative update
Restart
Required
Replaces
KB5002891, KB5002880, KB5002861, KB5002850
+9 earlier KB5002841, KB5002828, KB5002821, KB5002805, KB5002788, KB5002778, KB5002771, KB5002760, KB5002744
VersionBuildChannel
2016 16.0.5565.1001 General availability

Security

23 vulnerabilities fixed
2 critical 21 important
VulnerabilitySeverityCVSS
CVE-2026-62827
Microsoft SharePoint Server Elevation of Privilege Vulnerability
 Critical 8.8
CVE-2026-64921
Microsoft SharePoint Server Elevation of Privilege Vulnerability
 Critical 8.8
CVE-2026-70306
Microsoft Office SharePoint Spoofing Vulnerability
 Important 9.3
CVE-2026-63514
Microsoft SharePoint Server Remote Code Execution Vulnerability
 Important 8.8
CVE-2026-64901
Microsoft SharePoint Server Remote Code Execution Vulnerability
 Important 8.8
CVE-2026-65658
Microsoft SharePoint Server Remote Code Execution Vulnerability
 Important 8.8
CVE-2026-65660
Microsoft SharePoint Server Remote Code Execution Vulnerability
 Important 8.8
CVE-2026-65663
Microsoft SharePoint Server Remote Code Execution Vulnerability
 Important 8.8
CVE-2026-66805
Microsoft SharePoint Server Remote Code Execution Vulnerability
 Important 8.8
CVE-2026-66808
Microsoft SharePoint Server Remote Code Execution Vulnerability
 Important 8.8
CVE-2026-70324
Microsoft SharePoint Elevation of Privilege Vulnerability
 Important 8.8
CVE-2026-63520
Microsoft SharePoint Server Remote Code Execution Vulnerability
 Important 8.1
CVE-2026-64900
Microsoft SharePoint Server Spoofing Vulnerability
 Important 7.3
CVE-2026-58639
Microsoft SharePoint Server Spoofing Vulnerability
 Important 6.5
CVE-2026-62837
Microsoft SharePoint Server Information Disclosure Vulnerability
 Important 6.5
CVE-2026-62839
Microsoft SharePoint Server Spoofing Vulnerability
 Important 6.5
CVE-2026-63512
Microsoft SharePoint Server Tampering Vulnerability
 Important 6.5
CVE-2026-63516
Microsoft SharePoint Server Spoofing Vulnerability
 Important 6.5
CVE-2026-62917
Microsoft SharePoint Server Spoofing Vulnerability
 Important 4.6
CVE-2026-64897
Microsoft SharePoint Server Spoofing Vulnerability
 Important 4.6
CVE-2026-64902
Microsoft SharePoint Server Spoofing Vulnerability
 Important 4.6
CVE-2026-64916
Microsoft SharePoint Server Spoofing Vulnerability
 Important 4.6
CVE-2026-64922
Microsoft SharePoint Server Spoofing Vulnerability
 Important 4.6

Updated components

149 files changed since the previous update for the same versions.

Top changed componentsFiles
Document conversion10
Client object model7
Document management and policies6
Managed metadata3
Project Server3
Search3
Access Services1
PowerPoint1
PowerShell1
Publishing1
Workflow1

Verified in package: changed files confirm SharePoint 2010 Workflow, Business Data Connectivity, Workflow.

Page history

  1. Added CVE-2026-66805 (Important)

Sources

Updated
Cited passages from Microsoft's official notes (4)
  1. 1. Administrative Actions Logging - MinRole enhancements - SharePoint Custom Tiles - Hybrid Taxonomy - OneDrive API for SharePoint on-premises support.microsoft.com
  2. 2. Disables file-backed Business Data Connectivity (BDC) model import by default to improve security. support.microsoft.com
  3. 3. This public update delivers Feature Pack 2 for SharePoint Server 2016. Feature Pack 2 contains the following feature: support.microsoft.com
  4. 4. Fixes an issue in which Distributed Cache (DCache) does not work after the July 2026 Public Update is installed. support.microsoft.com
Checked automatically: 7 of 8 checks passed, 4 quoted passages · compared with Microsoft's page on Sep 26, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: not passed

A second AI read the text against the sources: correctness 5/5, clarity 4/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake