Skip to the content
The Update Bureau
SharePoint Server SE SharePoint Server SE Security update
Patch Tuesday

KB5002908

KB5002908: Cumulative update for SharePoint Server, version SE, September 2026. Workflow features change; server flaws patched

In short

Information disclosure, code execution and other flaws are patched, while several site features become disabled. Farms running SharePoint Workflow Manager need KB5002799 first.

Does it affect you? Applies to: SharePoint Server Subscription Edition servers with the release version installed. The package is for x64 systems.

Build
16.0.20326.20136
Security
19 fixed
Restart
Required

What changes

Removals 4 changes

GetDataFromDataSourceControl SOAP feature

  • The GetDataFromDataSourceControl feature is disabled. Administrators can turn it on for a site collection when needed.1
    Use Enable-SPWebPartPagesDataSourceControl to enable the feature for a site collection, or Disable-SPWebPartPagesDataSourceControl to turn it off.

ExecuteProxyUpdates feature

  • The ExecuteProxyUpdates feature is disabled. Administrators can turn it on for a site collection when needed.2
    Use Enable-SPWebPartPagesProxyUpdates to enable the feature, Disable-SPWebPartPagesProxyUpdates to turn it off, or Get-SPWebPartPagesProxyUpdatesEnabledSites to list enabled site collections.

SharePoint 2010 Workflow

Verified in package
  • The SharePoint 2010 Workflow feature is disabled. Administrators can turn it on for a site collection when needed.3
    Use Enable-SPLegacyWorkflow or Disable-SPLegacyWorkflow to change the setting. Use Get-SPLegacyWorkflowEnabledSites to list enabled site collections.

ToolPane feature

  • The ToolPane feature is disabled. Administrators can turn it on for a site collection when needed.4
    The page names Enable- SPToolPane, Disable- SPToolPane, and Get- SPToolPaneEnabledSites as the commands to manage and list enabled site collections.

Fixes 2 changes

User profile pictures

Verified in package
  • Updating user profile pictures no longer fails with a “Url is not safe” error.5
    Fixes failures when PowerShell, timer jobs, or profile synchronization update user profile pictures.

Pages

  • The screen no longer flickers when you scroll through or edit a page in certain browsers.6

Improvement 1 change

Search Filters panel

Verified in package
  • Closing the Search Filters panel returns keyboard focus to the Filters button.7

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2026-09-08
Classification
Security Updates
Type
Cumulative update
Restart
Required
Replaces
KB5002893, KB5002882, KB5002873, KB5002863
+26 earlier KB5002853, KB5002843, KB5002833, KB5002822, KB5002815, KB5002800, KB5002786, KB5002784, KB5002773, KB5002768, KB5002751, KB5002736, KB5002709, KB5002705, KB5002681, KB5002676, KB5002658, KB5002651, KB5002649, KB5002640, KB5002606, KB5002603, KB5002599, KB5002581, KB5002564, KB5002540
Replaced by
KB5002927
VersionBuildChannel
SE 16.0.20326.20136 General availability

Security

19 vulnerabilities fixed
18 important 1 not rated
VulnerabilitySeverityCVSS
CVE-2026-123390
Microsoft Office SharePoint Remote Code Execution Vulnerability
 Important 8.8
CVE-2026-123391
Microsoft Office SharePoint Elevation of Privilege Vulnerability
 Important 8.8
CVE-2026-69268
Microsoft Office SharePoint Remote Code Execution Vulnerability
 Important 8.8
CVE-2026-69273
Microsoft Office SharePoint Remote Code Execution Vulnerability
 Important 8.8
CVE-2026-69282
Microsoft Office SharePoint Remote Code Execution Vulnerability
 Important 8.8
CVE-2026-69464
Microsoft Office SharePoint Elevation of Privilege Vulnerability
 Important 8.8
CVE-2026-69465
Microsoft Office SharePoint Remote Code Execution Vulnerability
 Important 8.8
CVE-2026-69716
Microsoft Office SharePoint Elevation of Privilege Vulnerability
 Important 8.8
CVE-2026-69724
Microsoft Office SharePoint Remote Code Execution Vulnerability
 Important 8.8
CVE-2026-69804
Microsoft Office SharePoint Remote Code Execution Vulnerability
 Important 7.5
CVE-2026-69402
Microsoft Office SharePoint Spoofing Vulnerability
 Important 7.3
CVE-2026-69417
Microsoft Office SharePoint Spoofing Vulnerability
 Important 7.3
CVE-2026-69409
Microsoft Office SharePoint Information Disclosure Vulnerability
 Important 6.5
CVE-2026-69636
Microsoft Office SharePoint Information Disclosure Vulnerability
 Important 6.5
CVE-2026-69683
Microsoft Office SharePoint Information Disclosure Vulnerability
 Important 6.5
CVE-2026-69690
Microsoft Office SharePoint Spoofing Vulnerability
 Important 4.6
CVE-2026-69615
Microsoft Office SharePoint Spoofing Vulnerability
 Important 3.5
CVE-2026-69904
Microsoft Office SharePoint Information Disclosure Vulnerability
 Important 3.5
CVE-2026-65665
Microsoft SharePoint Server Remote Code Execution Vulnerability
 Not rated —

Updated components

1,280 files changed since the previous update for the same versions.

Top changed componentsFiles
Search202
Document conversion104
Client object model53
Project Server33
Document management and policies11
Office web apps8
Managed metadata6
PowerPoint6
PowerShell4
Translation Services3
Workflow3
Publishing2

Verified in package: changed files confirm SharePoint 2010 Workflow, User profile pictures, Search Filters panel.

Page history

  1. Added CVE-2026-123390 (Important)

    Added CVE-2026-123391 (Important)

Sources

Updated
Cited passages from Microsoft's official notes (7)
  1. 1. The GetDataFromDataSourceControl SOAP feature will be disabled starting in the September 2026 Cumulative Update. support.microsoft.com
  2. 2. The ExecuteProxyUpdates feature will be disabled starting in the September 2026 Cumulative Update. support.microsoft.com
  3. 3. Notifies that the SharePoint 2010 Workflow feature will be disabled starting with the September 2026 Cumulative Update. support.microsoft.com
  4. 4. Notifies that the ToolPane feature will be disabled starting with the September 2026 Cumulative Update. support.microsoft.com
  5. 5. Fixes an issue in which using PowerShell, timer jobs, or profile synchronization to update user profile pictures fails and returns a "Url is not safe" error message. support.microsoft.com
  6. 6. Fixes an issue in which the screen flickers when you scroll through or edit a page in certain browsers. support.microsoft.com
  7. 7. Closing the Search Filters panel now returns keyboard focus to the Filters button. support.microsoft.com
Checked automatically: 7 of 8 checks passed, 7 quoted passages · compared with Microsoft's page on Nov 8, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: not passed

A second AI read the text against the sources: correctness 5/5, clarity 5/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake