Skip to the content
The Update Bureau
SharePoint Server SE SharePoint Server SE Security update
Patch Tuesday

KB5002927

KB5002927: Cumulative update for SharePoint Server, version SE, October 2026. Critical elevation flaw closed; DCache works again

In short

The update fixes 39 vulnerabilities, including two critical flaws, and restores Distributed Cache after a prior update broke it. It also adds the 26H2 feature update and changes ImportWeb SOAP availability.

Does it affect you? Applies to: Servers running the release version of SharePoint Server Subscription Edition. The update package is for x64 systems.

Build
16.0.20326.20190
Security
39 fixed · 2 critical
Restart
Required

What changes

Fixes 3 changes

Security

  • The update closes security flaws involving information disclosure, remote code execution, spoofing, security-feature bypass, and elevation of privilege.1

Distributed Cache

For: Farms with the July 2026 Public Update

  • Distributed Cache works again after the problem caused by installing the July 2026 Public Update.2
    Fixes the issue in which Distributed Cache (DCache) does not work after the July 2026 Public Update is installed.

PSConfig

For: SharePoint farm administrators

  • Some PSConfig issues are fixed.3

Improvements 2 changes

Image picker

  • Screen readers announce image names in the Recent section instead of saying “bullet link,” making images easier to identify and select.4

ImportWeb SOAP

For: SharePoint farm administrators

  • ImportWeb SOAP is disabled starting with the October 2026 Cumulative Update. Administrators can enable it for a site collection if needed.5
    Use Enable-SPImportWeb -Identity [Site ID or URL] to enable the feature for a site collection, Get-SPImportWebEnabledSites to find enabled site collections, and Disable-SPImportWeb -Identity [Site ID or URL] to disable it when no longer required.

New feature 1 change

SharePoint Server Subscription Edition Version 26H2

For: SharePoint farm administrators

  • The 26H2 feature update is included, and future public updates will include it too.6

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2026-10-13
Classification
Security Updates
Type
Cumulative update
Restart
Required
Replaces
KB5002908, KB5002893, KB5002882, KB5002873
+27 earlier KB5002863, KB5002853, KB5002843, KB5002833, KB5002822, KB5002815, KB5002800, KB5002786, KB5002784, KB5002773, KB5002768, KB5002751, KB5002736, KB5002709, KB5002705, KB5002681, KB5002676, KB5002658, KB5002651, KB5002649, KB5002640, KB5002606, KB5002603, KB5002599, KB5002581, KB5002564, KB5002540
Replaced by
KB5002945
VersionBuildChannel
SE 16.0.20326.20190 General availability

Security

39 vulnerabilities fixed
2 critical 36 important 1 not rated
VulnerabilitySeverityCVSS
CVE-2026-97755
Microsoft Office Excel Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-102866
Microsoft Office SharePoint Elevation of Privilege Vulnerability
 Critical 8.1

The table lists the 2 exploited, publicly disclosed or critical vulnerabilities. See all 39 vulnerabilities →

Updated components

1,115 files changed since the previous update for the same versions.

Top changed componentsFiles
Search202
Document conversion97
Client object model49
Project Server34
Document management and policies13
Office web apps8
Managed metadata6
PowerPoint5
PowerShell4
Translation Services3
Workflow3
Publishing2

Page history

  1. Superseded by KB5002945

    Added CVE-2026-88176 (Important)

Sources

Updated
Cited passages from Microsoft's official notes (6)
  1. 1. This security update resolves a Microsoft SharePoint Server Information Disclosure, Microsoft SharePoint Server Remote Code Execution vulnerability support.microsoft.com
  2. 2. Fixes an issue in which Distributed Cache (DCache) does not work after the July 2026 Public Update is installed. support.microsoft.com
  3. 3. Fixes some issues related to PSConfig. support.microsoft.com
  4. 4. Enhances accessibility when selecting images. Screen readers now announce image names instead of "bullet link" in the Recent section of the image picker, making it easier to identify and select the desired image. support.microsoft.com
  5. 5. Notifies that the ImportWeb SOAP feature will be disabled starting in the October 2026 Cumulative Update. support.microsoft.com
  6. 6. This security update introduces the SharePoint Server Subscription Edition Version 26H2 feature update. This feature update will be included in all SharePoint Server Subscription Edition public updates going forward. support.microsoft.com
Checked automatically: 7 of 8 checks passed, 6 quoted passages · compared with Microsoft's page on Nov 14, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: not passed

A second AI read the text against the sources: correctness 5/5, clarity 4/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake