The Update BureauKB5002945: Cumulative update for SharePoint Server, version SE, November 2026. InfoPath and 2010 workflows face removal in July 2027
In short
InfoPath Forms Services and 2010 workflows are slated for removal on July 13, 2027. The update fixes an unexpected Search service stop and addresses important security flaws.
Does it affect you? Applies to: Farm administrators running the release version of SharePoint Server Subscription Edition. The package is for x64 systems.
What changes
Improvements 3 changes
Time zones
For: SharePoint farm administrators
-
Adds permanent time zones for Alberta and British Columbia and keeps their past daylight saving time changes through March 2026.1
Adds Alberta (UTC-6) and British Columbia (UTC-7) permanent time zones.
Remote event receivers
For: SharePoint farm administrators
-
Blocking remote event receivers without an application identity is delayed until the March 2027 Public Update.2
Use
Get-SPOrphanedRemoteEventReceiverto find affected receivers registered at the list level.
InfoPath Forms Services
For: SharePoint farm administrators
-
Admins can re-enable InfoPath Forms Services with the documented farm settings, although the feature is off by default.3
Re-enabling it requires the
DisableInfoPathRetirementdebug flag (5023), browser form rendering, and browser form activation.
Fix 1 change
SharePoint Search Host Controller service
Verified in package
For: SharePoint farm administrators
-
The Search service should no longer stop unexpectedly after someone manually stops and restarts it.4
Fixes an issue in which the SharePoint Search Host Controller service might stop unexpectedly after a manual stop and restart.
Technical details
Data sheet · Security · Downloads · Components Click to collapse or expand
Data sheet
- Released
- 2026-11-10
- Classification
- Security Updates
- Type
- Cumulative update
- Restart
- Required
- Replaces
-
KB5002927, KB5002908, KB5002893, KB5002882
+28 earlier
KB5002873, KB5002863, KB5002853, KB5002843, KB5002833, KB5002822, KB5002815, KB5002800, KB5002786, KB5002784, KB5002773, KB5002768, KB5002751, KB5002736, KB5002709, KB5002705, KB5002681, KB5002676, KB5002658, KB5002651, KB5002649, KB5002640, KB5002606, KB5002603, KB5002599, KB5002581, KB5002564, KB5002540
| Version | Build | Channel |
|---|---|---|
| SE | 16.0.20326.20278 | General availability |
Security
| Vulnerability | Severity | CVSS |
|---|---|---|
|
Microsoft SharePoint Server Elevation of Privilege Vulnerability
|
Important | 9.9 |
|
Microsoft Office SharePoint Spoofing Vulnerability
|
Important | 9.0 |
|
Microsoft Office SharePoint Elevation of Privilege Vulnerability
|
Important | 9.0 |
|
Microsoft Office SharePoint Remote Code Execution Vulnerability
|
Important | 8.8 |
|
Microsoft Office SharePoint Remote Code Execution Vulnerability
|
Important | 8.8 |
|
Microsoft Office SharePoint Remote Code Execution Vulnerability
|
Important | 8.8 |
|
Microsoft Office SharePoint Elevation of Privilege Vulnerability
|
Important | 8.8 |
|
Microsoft Office SharePoint Remote Code Execution Vulnerability
|
Important | 8.8 |
|
Microsoft Office SharePoint Elevation of Privilege Vulnerability
|
Important | 8.0 |
|
Microsoft Office SharePoint Elevation of Privilege Vulnerability
|
Important | 8.0 |
|
Microsoft Office SharePoint Spoofing Vulnerability
|
Important | 8.0 |
|
Microsoft Office SharePoint Remote Code Execution Vulnerability
|
Important | 7.5 |
|
Microsoft Office SharePoint Spoofing Vulnerability
|
Important | 7.3 |
|
Microsoft Office SharePoint Spoofing Vulnerability
|
Important | 7.3 |
|
Microsoft Office SharePoint Spoofing Vulnerability
|
Important | 7.3 |
|
Microsoft Office SharePoint Spoofing Vulnerability
|
Important | 7.3 |
|
Microsoft Office SharePoint Spoofing Vulnerability
|
Important | 7.3 |
|
Microsoft Office SharePoint Spoofing Vulnerability
|
Important | 7.3 |
|
Microsoft Office SharePoint Elevation of Privilege Vulnerability
|
Important | 6.6 |
|
Microsoft Office SharePoint Information Disclosure Vulnerability
|
Important | 6.5 |
|
Microsoft Office SharePoint Information Disclosure Vulnerability
|
Important | 6.5 |
|
Microsoft Office SharePoint Information Disclosure Vulnerability
|
Important | 6.5 |
|
Microsoft Office SharePoint Spoofing Vulnerability
|
Important | 5.3 |
|
Microsoft Office SharePoint Spoofing Vulnerability
|
Important | 4.6 |
Downloads (Microsoft Update Catalog)
Package
SE
1.6 GB
sts-x-none.cab
Language packs (49)
- Arabic (Saudi Arabia)
- Azerbaijani (Latin, Azerbaijan)
- Basque (Spain)
- Bosnian (Latin, Bosnia & Herzegovina)
- Bulgarian (Bulgaria)
- Catalan (Spain)
- Chinese (China)
- Chinese (Taiwan)
- Croatian (Croatia)
- Czech (Czechia)
- Danish (Denmark)
- Dutch (Netherlands)
- English (United States)
- Estonian (Estonia)
- Finnish (Finland)
- French (France)
- Galician (Spain)
- German (Germany)
- Greek (Greece)
- Hebrew (Israel)
- Hindi (India)
- Hungarian (Hungary)
- Indonesian (Indonesia)
- Irish (Ireland)
- Italian (Italy)
- Japanese (Japan)
- Kazakh (Kazakhstan)
- Korean (South Korea)
- Latvian (Latvia)
- Lithuanian (Lithuania)
- Macedonian (North Macedonia)
- Malay (Malaysia)
- Norwegian Bokmål (Norway)
- Polish (Poland)
- Portuguese (Brazil)
- Portuguese (Portugal)
- Romanian (Romania)
- Russian (Russia)
- Serbian (Cyrillic, Serbia)
- Serbian (Latin, Serbia)
- Slovak (Slovakia)
- Slovenian (Slovenia)
- Spanish (Spain)
- Swedish (Sweden)
- Thai (Thailand)
- Turkish (Türkiye)
- Ukrainian (Ukraine)
- Vietnamese (Vietnam)
- Welsh (United Kingdom)
Updated components
1,326 files changed since the previous update for the same versions.
| Top changed components | Files |
|---|---|
| Search | 202 |
| Document conversion | 100 |
| Client object model | 53 |
| Project Server | 35 |
| Document management and policies | 13 |
| Office web apps | 8 |
| Managed metadata | 6 |
| PowerPoint | 6 |
| PowerShell | 3 |
| Translation Services | 3 |
| Workflow | 3 |
| Publishing | 2 |
Verified in package: changed files confirm SharePoint Search Host Controller service.
Page history
-
Added 13 vulnerabilities
Removed CVE-2026-88176
Now also covers build 16.0.20326.20278 (SE)
Sources
Updated
Cited passages from Microsoft's official notes (4)
-
1.
Adds support for the permanent time zones in Alberta (UTC-6) and British Columbia (UTC-7), and keeps the historical daylight saving time transitions for both provinces through March 2026.
support.microsoft.com -
2.
SharePoint Server will start blocking remote event receivers that are registered without an application identity in the March 2027 Public Update, not the November 2026 Public Update as previously announced.
support.microsoft.com -
3.
To enable the feature, add the
support.microsoft.comDisableInfoPathRetirementdebug flag (5023) to the SharePoint farm, enable browser form rendering, and enable browser form activation. -
4.
Fixes an issue in SharePoint Server Subscription Edition in which the SharePoint Search Host Controller service might stop unexpectedly after you manually stop and restart it.
support.microsoft.com
Checked automatically: 8 of 8 checks passed, 4 quoted passages · compared with Microsoft's page on Nov 15, 2026
- Quotes found in the official pages: passed
- Numbers found in the sources: passed
- Vulnerabilities from the dossier only: passed
- Links to allowed domains only: passed
- Every official change covered: passed
- Readable plain text: passed
- Changes confirmed by the file list: passed
- Sources agree: passed
A second AI read the text against the sources: correctness 5/5, clarity 4/5, completeness 5/5. How we work
Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake