Skip to the content
The Update Bureau

SharePoint Server

SharePoint Server updates

All published releases for SharePoint Server, newest first: what each update changes, whether to install it and any confirmed known issues. Latest release: November 10, 2026.

15 active known issues →

Latest build per version

SharePoint Server updates

  • SharePoint Server SE SharePoint Server SE Security update
    Updated

    KB5002945

    InfoPath and 2010 workflows face removal in July 2027

    InfoPath Forms Services and 2010 workflows are slated for removal on July 13, 2027. The update fixes an unexpected Search service stop and addresses important security flaws.

    A July 13, 2027 public update removes SharePoint 2010 workflows and InfoPath Forms Services. Migrate any workflows or forms that still rely on them.

    Key changes 24 CVEs · 4 changes

    • Improved Time zones: Adds permanent time zones for Alberta and British Columbia and keeps their past daylight saving time changes through March 2026.
    • Improved Remote event receivers: Blocking remote event receivers without an application identity is delayed until the March 2027 Public Update.
    • Improved InfoPath Forms Services: Admins can re-enable InfoPath Forms Services with the documented farm settings, although the feature is off by default.

    Read update Source: Microsoft

    Build
    16.0.20326.20278
    Security
    24 vulnerabilities fixed
    Restart
    Required
  • SharePoint Server SE SharePoint Server SE Security update
    Updated

    KB5002927

    Critical elevation flaw closed; DCache works again

    The update fixes 39 vulnerabilities, including two critical flaws, and restores Distributed Cache after a prior update broke it. It also adds the 26H2 feature update and changes ImportWeb SOAP availability.

    Check the newer update, KB5002945

    Key changes 39 CVEs · 6 changes

    • New SharePoint Server Subscription Edition Version 26H2: The 26H2 feature update is included, and future public updates will include it too.
    • Improved Image picker: Screen readers announce image names in the Recent section instead of saying “bullet link,” making images easier to identify and select.
    • Improved ImportWeb SOAP: ImportWeb SOAP is disabled starting with the October 2026 Cumulative Update. Administrators can enable it for a site collection if need...

    Read update Source: Microsoft

    Build
    16.0.20326.20190
    Security
    39 fixed · 2 critical
    Restart
    Required
  • SharePoint Server SE SharePoint Server SE Security update
    Updated

    KB5002908

    Workflow features change; server flaws patched

    Information disclosure, code execution and other flaws are patched, while several site features become disabled. Farms running SharePoint Workflow Manager need KB5002799 first.

    Check the newer update, KB5002927

    Key changes 19 CVEs · 7 changes

    • Improved Search Filters panel: Closing the Search Filters panel returns keyboard focus to the Filters button.
    • Fix User profile pictures: Updating user profile pictures no longer fails with a “Url is not safe” error.
    • Fix Pages: The screen no longer flickers when you scroll through or edit a page in certain browsers.

    Read update Source: Microsoft

    Build
    16.0.20326.20136
    Security
    19 vulnerabilities fixed
    Restart
    Required
  • SharePoint Server SE SharePoint Server SE Security update
    Updated

    KB5002893

    Critical privilege and code-execution flaws patched; workflow changes ahead

    Critical flaws include privilege escalation and remote code execution risks. The update also fixes broken cache and workflow links.

    Check the newer update, KB5002908

    Key changes 30 CVEs · 9 changes

    • New SharePoint 2013 workflows: The update adds an advisory for SharePoint 2013 workflows.
    • Improved ExecuteProxyUpdates: The ExecuteProxyUpdates feature will be disabled starting with the September 2026 Cumulative Update.
    • Improved Remote Event Receivers (RERs): Orphaned Remote Event Receivers without an app identifier will be blocked starting with the November 2026 Public Update.

    Read update Source: Microsoft

    Build
    16.0.19725.20522
    Security
    30 fixed · 3 critical
    Restart
    Required
  • SharePoint Server 2019 SharePoint Server 2019 Security update
    Final update for this version Updated

    KB5002894

    Remote-code execution and privilege-escalation risks addressed

    The update addresses 27 vulnerabilities, including three critical SharePoint Server flaws involving remote-code execution and privilege escalation. It also fixes broken workflow status links and changes several SharePoint features.

    Microsoft's lifecycle data lists July 14, 2026 as the end date for updates across all editions. This is an end-of-updates date, not a stated end-of-support date.

    Key changes 27 CVEs · 8 changes

    • Improved SharePoint 2013 workflows: An advisory is provided for SharePoint 2013 workflows.
    • Improved Remote Event Receivers: Orphaned Remote Event Receivers without an app identifier might be blocked in the future.
    • Improved ToolPane: The ToolPane feature might be disabled in the future.

    Read update Source: Microsoft

    Build
    16.0.10417.20198
    Security
    27 fixed · 3 critical
    Restart
    Required
  • SharePoint Server 2016 SharePoint Server 2016 Security update
    Final update for this version Updated

    KB5002905

    Two critical privilege flaws; workflow and cache fixes

    Fixes two critical SharePoint Server elevation-of-privilege vulnerabilities and resolves problems with workflow links, Distributed Cache, and Office Online Server document editing.

    SharePoint Server 2016 reached the end of updates on July 14, 2026.

    Key changes 23 CVEs · 17 changes

    • New SharePoint Framework: SharePoint Framework is included with Feature Pack 2.
    • New Administrative Actions Logging: Administrative Actions Logging is included with Feature Pack 1.
    • New SharePoint Custom Tiles: SharePoint Custom Tiles are included with Feature Pack 1.

    Read update Source: Microsoft

    Build
    16.0.5565.1001
    Security
    23 fixed · 2 critical
    Restart
    Required
  • SharePoint Server SE SharePoint Server SE Security update
    Zero-day Updated

    KB5002882

    Exploited elevation flaw patched; legacy workflows start again

    An exploited elevation-of-privilege flaw is patched, and SharePoint 2010 workflows that failed to start after June's update work again.

    Check the newer update, KB5002893
    Known issues: 3 open Organizations and IT administrators
    • Customers in multi-front-end SharePoint farms with Trusted Provider or Forms authentication may face repeated authentication prompts or multiple sign-ins.
    • When a workflow status link is selected, WrkStat.aspx displays the following error message: The WorkflowInstanceID parameter is invalid.
    • After you run PSConfig, run the following PowerShell commands.

    Key changes 39 CVEs · 1 change

    • Fix SharePoint 2010 workflows: SharePoint 2010 workflows that stopped starting after the June 2026 update can start again.
    • Exploited CVE-2026-56164: Microsoft SharePoint Server Elevation of Privilege Vulnerability
    • Critical CVE-2026-50522: Microsoft SharePoint Remote Code Execution Vulnerability

    Read update Source: Microsoft

    Build
    16.0.19725.20434
    Security
    39 fixed · 6 critical · 1 exploited
    Restart
    Required
  • SharePoint Server 2019 SharePoint Server 2019 Security update
    Zero-day Updated

    KB5002883

    Exploited privilege flaw patched; workflow and page fixes

    An actively exploited privilege flaw is patched, alongside fixes for page loading and SharePoint 2010 workflows. Support for version 2019 ends on July 14, 2026.

    Check the newer update, KB5002894
    Updates for all SharePoint Server 2019 editions ended on July 14, 2026.
    Known issues: 2 open Organizations and IT administrators
    • Customers in multi-front-end SharePoint farms with Trusted Provider or Forms authentication may face repeated authentication prompts or multiple sign-ins.
    • When a workflow status link is selected, WrkStat.aspx displays the following error message: The WorkflowInstanceID parameter is invalid.

    Key changes 40 CVEs · 2 changes

    • Fix SharePoint pages: Pages can load when certain user controls were flagged as unsafe for security.
    • Fix SharePoint 2010 workflows: SharePoint 2010 workflows can start after the June 2026 update is installed.
    • Exploited CVE-2026-56164: Microsoft SharePoint Server Elevation of Privilege Vulnerability

    Read update Source: Microsoft

    Build
    16.0.10417.20175
    Security
    40 fixed · 6 critical · 1 exploited
    Restart
    Required
  • SharePoint Server 2016 SharePoint Server 2016 Security update
    Zero-day Updated

    KB5002891

    Exploited privilege flaw patched; final update for this version

    Attackers are exploiting a SharePoint Server privilege flaw. This is the final update for this version and includes fixes for critical security vulnerabilities.

    Check the newer update, KB5002905
    July 14, 2026, is the final update date for all editions of SharePoint Server 2016.
    Known issues: 3 open Organizations and IT administrators
    • Customers in multi-front-end SharePoint farms with Trusted Provider or Forms authentication may face repeated authentication prompts or multiple sign-ins.
    • When a workflow status link is selected, WrkStat.aspx displays the following error message: The WorkflowInstanceID parameter is invalid.
    • Customers who install the SharePoint 2016 July Public Update might find that Office Online Server can't render or edit documents.

    Key changes 40 CVEs · 8 changes

    • New SharePoint Framework (SPFx): SharePoint Framework is included in Feature Pack 2.
    • New Administrative Actions Logging: Feature Pack 1 includes Administrative Actions Logging.
    • New SharePoint Custom Tiles: Feature Pack 1 includes SharePoint Custom Tiles.

    Read update Source: Microsoft

    Build
    16.0.5561.1001
    Security
    40 fixed · 6 critical · 1 exploited
    Restart
    Required
  • SharePoint Server SE SharePoint Server SE Security update
    Zero-day

    KB5002873

    Closes exploited remote-code execution flaw; adds 26H1 features

    Closes an actively exploited SharePoint remote-code execution flaw (CVE-2026-58644), among 32 vulnerabilities, and introduces the 26H1 feature update alongside several fixes.

    Check the newer update, KB5002882

    Key changes 32 CVEs · 6 changes

    • New SharePoint Server Subscription Edition: The Version 26H1 feature update is included, and future public updates will include it too.
    • Improved Property Pane: When the Property Pane is open, selecting the editor lets users return focus to it.
    • Fix Document web part: Multi-value managed metadata fields can be viewed and edited in the document web part.

    Read update Source: Microsoft

    Build
    16.0.19725.20384
    Security
    32 fixed · 3 critical · 1 exploited
    Restart
    Required
  • SharePoint Server 2019 SharePoint Server 2019 Security update
    Zero-day

    KB5002874

    Actively exploited remote-code flaw patched; 2019 updates end July 14

    Fixes security vulnerabilities in SharePoint Server 2019, including an actively exploited remote-code flaw. Updates for this version end July 14, 2026.

    Check the newer update, KB5002883
    Updates for SharePoint Server 2019 end July 14, 2026, across all editions.

    Key changes 32 CVEs · 1 change

    • Fix Security: The update resolves vulnerabilities that could allow remote code execution, spoofing, elevation of privilege, or information disclosure...
    • Exploited CVE-2026-58644: Microsoft SharePoint Remote Code Execution Vulnerability
    • Critical CVE-2026-45456: Microsoft Outlook and Word Remote Code Execution Vulnerability

    Read update Source: Microsoft

    Build
    16.0.10417.20153
    Security
    32 fixed · 3 critical · 1 exploited
    Restart
    Required
  • SharePoint Server 2016 SharePoint Server 2016 Security update
    Zero-day

    KB5002880

    Actively exploited remote-code flaw patched before support ends

    The update patches an actively exploited remote-code execution flaw and other vulnerabilities. SharePoint Server 2016 updates end on July 14, 2026.

    Check the newer update, KB5002891
    Updates for SharePoint Server 2016 end on July 14, 2026, for all editions.

    Key changes 30 CVEs · 9 changes

    • New SharePoint Framework: Feature Pack 2 delivers SharePoint Framework.
    • New Administrative Actions Logging: Feature Pack 1 includes Administrative Actions Logging.
    • New MinRole: Feature Pack 1 includes MinRole enhancements.

    Read update Source: Microsoft

    Build
    16.0.5556.1005
    Security
    30 fixed · 3 critical · 1 exploited
    Restart
    Required
  • SharePoint Server SE SharePoint Server SE Security update

    KB5002863

    Remote-code flaws addressed; Quick Edit gains keyboard navigation

    Addresses 9 vulnerabilities, including two critical remote-code execution flaws: CVE-2026-40365 in SharePoint Server and CVE-2026-40367 in Word. It also improves Quick Edit keyboard access and fixes farm-management issues.

    Check the newer update, KB5002873

    Key changes 9 CVEs · 6 changes

    • Improved SPList Quick Edit view: Keyboard navigation reaches column headers in the SPList Quick Edit view.
    • Improved Ingestion: Ingestion throughput improves.
    • Fix SharePoint Server: The update addresses a remote code execution vulnerability in SharePoint Server.

    Read update Source: Microsoft

    Build
    16.0.19725.20280
    Security
    9 fixed · 2 critical
    Restart
    Required
  • SharePoint Server 2019 SharePoint Server 2019 Security update

    KB5002870

    Two critical code-execution flaws resolved; accessibility improved

    The update resolves 9 vulnerabilities, including two critical remote-code-execution flaws, and fixes accessibility and page-loading problems. Updates for this server version end July 14, 2026.

    Check the newer update, KB5002874
    Updates for all editions of SharePoint Server 2019 end July 14, 2026.

    Key changes 9 CVEs · 5 changes

    • Fix Microsoft Word: A remote-code-execution vulnerability in Microsoft Word is resolved.
    • Fix SharePoint Server: A remote-code-execution vulnerability in SharePoint Server is resolved.
    • Fix Accessibility: Decorative images are marked so screen readers ignore them instead of announcing them as graphics.

    Read update Source: Microsoft

    Build
    16.0.10417.20128
    Security
    9 fixed · 2 critical
    Restart
    Required
  • SharePoint Server 2016 SharePoint Server 2016 Security update

    KB5002868

    Critical server code-execution flaw; some pages fail to render

    The update addresses 9 vulnerabilities, including critical remote-code execution flaws in SharePoint Server and Word. It also fixes rendering on some SharePoint pages.

    Updates for SharePoint Server 2016 end on July 14, 2026.

    Key changes 9 CVEs · 3 changes

    • New SharePoint Framework (SPFx): Feature Pack 2, which includes SharePoint Framework (SPFx), is delivered with this update.
    • New Feature Pack 1: The update also delivers Administrative Actions Logging, MinRole enhancements, SharePoint Custom Tiles, Hybrid Taxonomy, the OneDrive A...
    • Fix SharePoint pages: Some SharePoint pages render again.

    Read update Source: Microsoft

    Build
    16.0.5552.1002
    Security
    9 fixed · 2 critical
    Restart
    Required
  • SharePoint Server SE SharePoint Server SE Security update
    Zero-day

    KB5002853

    An exploited spoofing flaw and publishing-page fixes

    Closes an exploited spoofing vulnerability and fixes several issues, including publishing pages that show the wrong interface and a rich text editor that cannot insert line breaks.

    Check the newer update, KB5002863

    Key changes 2 CVEs · 6 changes

    • Improved Search: Search ingestion processes content faster through a higher cache hit rate.
    • Fix SharePoint Server: The GB18030-2022 certification issue is fixed.
    • Fix Publishing pages: Appending p=2 to a publishing page URL no longer makes the page show a File Picker-style interface instead of the expected page.

    Read update Source: Microsoft

    Build
    16.0.19725.20210
    Security
    2 vulnerabilities fixed · 1 actively exploited
    Restart
    Required
  • SharePoint Server 2019 SharePoint Server 2019 Security update
    Zero-day

    KB5002854

    Exploited spoofing flaw patched; pages render again

    Addresses an actively exploited spoofing flaw and fixes an issue that kept some pages from rendering. SharePoint Server 2019 updates end July 14, 2026.

    Check the newer update, KB5002870
    Updates for all SharePoint Server 2019 editions end July 14, 2026.

    Key changes 2 CVEs · 2 changes

    • Fix SharePoint Server: Addresses an actively exploited flaw that could let an attacker spoof SharePoint Server.
    • Fix SharePoint pages: Some SharePoint pages render again instead of failing to display.
    • Exploited CVE-2026-32201: Microsoft SharePoint Server Spoofing Vulnerability

    Read update Source: Microsoft

    Build
    16.0.10417.20114
    Security
    2 vulnerabilities fixed · 1 actively exploited
    Restart
    Required
  • SharePoint Server 2016 SharePoint Server 2016 Security update
    Zero-day

    KB5002861

    Exploited server spoofing flaw addressed; page rendering fixed

    Addresses an exploited server spoofing vulnerability and fixes an issue that kept some pages from rendering. It also delivers SharePoint Feature Pack 2, including the SharePoint Framework.

    Check the newer update, KB5002868
    Updates for SharePoint Server 2016 end on July 14, 2026, for all editions.

    Key changes 2 CVEs · 9 changes

    • New SharePoint Framework (SPFx): Feature Pack 2 includes the SharePoint Framework.
    • New Administrative Actions Logging: Feature Pack 1 includes Administrative Actions Logging.
    • New MinRole enhancements: Feature Pack 1 includes MinRole enhancements.

    Read update Source: Microsoft

    Build
    16.0.5548.1003
    Security
    2 vulnerabilities fixed · 1 actively exploited
    Restart
    Required
  • SharePoint Server SE SharePoint Server SE Security update

    KB5002843

    Critical Office code-execution flaw fixed; direct upgrade can fail

    The update fixes three security vulnerabilities, including a critical Office remote-code execution flaw. SharePoint Server Subscription Edition farms moving directly from the January to March update can hit a PSConfig failure.

    Check the newer update, KB5002853
    Known issues: 1 open Organizations and IT administrators
    • For SharePoint Server Subscription Edition customers who are currently on the January 2026 public update, updating directly to the March 2026 public update fails when you run the SharePoint Products Configuration Wizard (PSConfig).

    Key changes 3 CVEs · 5 changes

    • Improved Hybrid Search: Hybrid Search makes fewer redundant onboarding requests and waits 15 minutes between consecutive failures.
    • Improved Hybrid Search: The Hybrid Search onboarding script uses a customer-owned application.
    • Fix Security: The update fixes a critical Office remote-code execution vulnerability and SharePoint Server remote-code execution and spoofing vulnera...

    Read update Source: Microsoft

    Build
    16.0.19725.20076
    Security
    3 fixed · 1 critical
    Restart
    Required
  • SharePoint Server 2019 SharePoint Server 2019 Security update

    KB5002845

    Critical Office code flaw addressed; pages render again

    The update addresses four vulnerabilities, including a critical Microsoft Office remote code execution flaw, and fixes an issue where some SharePoint pages do not render.

    Check the newer update, KB5002854
    Support for all SharePoint Server 2019 editions ends July 14, 2026.

    Key changes 4 CVEs · 1 change

    • Fix SharePoint pages: Some SharePoint pages that did not render now render.
    • Critical CVE-2026-26113: Microsoft Office Remote Code Execution Vulnerability
    • CVSS 8.8 CVE-2026-26106: Microsoft SharePoint Server Remote Code Execution Vulnerability

    Read update Source: Microsoft

    Build
    16.0.10417.20102
    Security
    4 fixed · 1 critical
    Restart
    Required
  • SharePoint Server 2016 SharePoint Server 2016 Security update

    KB5002850

    Critical Office remote-code flaw patched; pages render again

    The update closes four vulnerabilities, including a critical Office remote-code flaw, and fixes an issue that kept some pages from rendering. It also delivers SharePoint Framework (SPFx).

    Check the newer update, KB5002861
    Updates for SharePoint Server 2016 end on July 14, 2026.

    Key changes 4 CVEs · 4 changes

    • New SharePoint Framework (SPFx): Feature Pack 2 adds SharePoint Framework (SPFx).
    • New Feature Pack 1: The update also delivers Feature Pack 1 features, including new administration, hybrid, and OneDrive capabilities.
    • Fix Security: Remote code execution vulnerabilities in SharePoint Server and Office, and a SharePoint Server spoofing vulnerability, are resolved.

    Read update Source: Microsoft

    Build
    16.0.5543.1000
    Security
    4 fixed · 1 critical
    Restart
    Required
  • SharePoint Server SE SharePoint Server SE Security update

    KB5002833

    Word and Outlook spoofing flaws patched; farm issues fixed

    The update fixes two Important spoofing vulnerabilities affecting Word and Outlook, adds the Version 25H2 feature update, and addresses SharePoint farm, workflow, and document-handling problems.

    Check the newer update, KB5002843

    Key changes 2 CVEs · 10 changes

    • New Version 25H2 feature update: The Version 25H2 feature update is included, and future public updates will include it too.
    • Improved People Picker: Configurable access controls can limit the People Picker to authorized users by excluding the Everyone claim.
    • Fix Zero downtime updating: Zero-downtime updating is no longer blocked.

    Read update Source: Microsoft

    Build
    16.0.19127.20518
    Security
    2 vulnerabilities fixed
    Restart
    Required
  • SharePoint Server 2019 SharePoint Server 2019 Security update

    KB5002834

    Word and Outlook spoofing flaws fixed; web-process stalls addressed

    The update fixes two Important Word and Outlook spoofing flaws—tricks that make content appear to come from a trusted source—and addresses repeated SharePoint web-process stalls.

    Check the newer update, KB5002845
    SharePoint Server 2019 updates end on July 14, 2026.

    Key changes 2 CVEs · 3 changes

    • Fix GB18030-2022 China certification: The GB18030-2022 China certification issue is fixed.
    • Fix SharePoint Server: SharePoint's process for handling web requests no longer repeatedly stops responding.
    • Fix Set-SPMachineKey: Administrators can use Set-SPMachineKey to set machine keys again after installing the September 2025 cumulative update.

    Read update Source: Microsoft

    Build
    16.0.10417.20097
    Security
    2 vulnerabilities fixed
    Restart
    Required
  • SharePoint Server 2016 SharePoint Server 2016 Security update

    KB5002841

    Word and Outlook spoofing flaws fixed; machine-key setting restored

    The update fixes two Important spoofing vulnerabilities affecting Word and Outlook, and restores the ability to set SharePoint machine keys after the September 2025 cumulative update.

    Check the newer update, KB5002850
    Updates for SharePoint Server 2016 end on July 14, 2026.

    Key changes 2 CVEs · 10 changes

    • New SharePoint Framework (SPFx): SharePoint Framework is included as part of Feature Pack 2.
    • New Administrative Actions Logging: Administrative Actions Logging is included among the features delivered from Feature Pack 1.
    • New MinRole enhancements: MinRole enhancements are included among the features delivered from Feature Pack 1.

    Read update Source: Microsoft

    Build
    16.0.5539.1002
    Security
    2 vulnerabilities fixed
    Restart
    Required
  • SharePoint Server SE SharePoint Server SE Security update

    KB5002822

    Eight vulnerabilities addressed as the 25H2 feature update arrives

    The update addresses eight vulnerabilities and introduces the 25H2 feature update. It also fixes SharePoint issues affecting accessibility, content display, and data migration.

    Check the newer update, KB5002833

    Key changes 8 CVEs · 16 changes

    • New SharePoint Server Subscription Edition: The 25H2 feature update is included. Future public updates will also include it.
    • Improved SharePoint Workflow Manager: Farms running SharePoint Workflow Manager need its November update before installing this cumulative update.
    • Improved Classic Workflow Manager: Classic Workflow Manager can continue to be used after its debug flag is enabled.

    Read update Source: Microsoft

    Build
    16.0.19127.20442
    Security
    8 vulnerabilities fixed
    Restart
    Required