SharePoint Server Subscription Edition

Build history

• SharePoint Server SE SharePoint Server SE Security update

  Updated Nov 11

  KB5002945 Nov 10, 2026

  InfoPath and 2010 workflows face removal in July 2027

  InfoPath Forms Services and 2010 workflows are slated for removal on July 13, 2027. The update fixes an unexpected Search service stop and addresses important security flaws.

  A July 13, 2027 public update removes SharePoint 2010 workflows and InfoPath Forms Services. Migrate any workflows or forms that still rely on them.

  Key changes 24 CVEs · 4 changes

  • Improved Time zones: Adds permanent time zones for Alberta and British Columbia and keeps their past daylight saving time changes through March 2026.
  • Improved Remote event receivers: Blocking remote event receivers without an application identity is delayed until the March 2027 Public Update.
  • Improved InfoPath Forms Services: Admins can re-enable InfoPath Forms Services with the documented farm settings, although the feature is off by default.

  Read update → Source: Microsoft ↗

• SharePoint Server SE SharePoint Server SE Security update

  Updated Nov 10

  KB5002927 Oct 13, 2026

  Critical elevation flaw closed; DCache works again

  The update fixes 39 vulnerabilities, including two critical flaws, and restores Distributed Cache after a prior update broke it. It also adds the 26H2 feature update and changes ImportWeb SOAP availability.

  Check the newer update, KB5002945

  Key changes 39 CVEs · 6 changes

  • New SharePoint Server Subscription Edition Version 26H2: The 26H2 feature update is included, and future public updates will include it too.
  • Improved Image picker: Screen readers announce image names in the Recent section instead of saying “bullet link,” making images easier to identify and select.
  • Improved ImportWeb SOAP: ImportWeb SOAP is disabled starting with the October 2026 Cumulative Update. Administrators can enable it for a site collection if need...

  Read update → Source: Microsoft ↗

• SharePoint Server SE SharePoint Server SE Security update

  Updated Nov 10

  KB5002908 Sep 8, 2026

  Workflow features change; server flaws patched

  Information disclosure, code execution and other flaws are patched, while several site features become disabled. Farms running SharePoint Workflow Manager need KB5002799 first.

  Check the newer update, KB5002927

  Key changes 19 CVEs · 7 changes

  • Improved Search Filters panel: Closing the Search Filters panel returns keyboard focus to the Filters button.
  • Fix User profile pictures: Updating user profile pictures no longer fails with a “Url is not safe” error.
  • Fix Pages: The screen no longer flickers when you scroll through or edit a page in certain browsers.

  Read update → Source: Microsoft ↗

• SharePoint Server SE SharePoint Server SE Security update

  Updated Nov 8

  KB5002893 Aug 11, 2026

  Critical privilege and code-execution flaws patched; workflow changes ahead

  Critical flaws include privilege escalation and remote code execution risks. The update also fixes broken cache and workflow links.

  Check the newer update, KB5002908

  Key changes 30 CVEs · 9 changes

  • New SharePoint 2013 workflows: The update adds an advisory for SharePoint 2013 workflows.
  • Improved ExecuteProxyUpdates: The ExecuteProxyUpdates feature will be disabled starting with the September 2026 Cumulative Update.
  • Improved Remote Event Receivers (RERs): Orphaned Remote Event Receivers without an app identifier will be blocked starting with the November 2026 Public Update.

  Read update → Source: Microsoft ↗

• SharePoint Server SE SharePoint Server SE Security update

  Zero-day Updated Nov 8

  KB5002882 Jul 14, 2026

  Exploited elevation flaw patched; legacy workflows start again

  An exploited elevation-of-privilege flaw is patched, and SharePoint 2010 workflows that failed to start after June's update work again.

  Check the newer update, KB5002893

  Known issues: 3 open Organizations and IT administrators

  • Customers in multi-front-end SharePoint farms with Trusted Provider or Forms authentication may face repeated authentication prompts or multiple sign-ins.
  • When a workflow status link is selected, WrkStat.aspx displays the following error message: The WorkflowInstanceID parameter is invalid.
  • After you run PSConfig, run the following PowerShell commands.

  Key changes 39 CVEs · 1 change

  • Fix SharePoint 2010 workflows: SharePoint 2010 workflows that stopped starting after the June 2026 update can start again.
  • Exploited CVE-2026-56164: Microsoft SharePoint Server Elevation of Privilege Vulnerability
  • Critical CVE-2026-50522: Microsoft SharePoint Remote Code Execution Vulnerability

  Read update → Source: Microsoft ↗

• SharePoint Server SE SharePoint Server SE Security update

  Zero-day

  KB5002873 Jun 9, 2026

  Closes exploited remote-code execution flaw; adds 26H1 features

  Closes an actively exploited SharePoint remote-code execution flaw (CVE-2026-58644), among 32 vulnerabilities, and introduces the 26H1 feature update alongside several fixes.

  Check the newer update, KB5002882

  Key changes 32 CVEs · 6 changes

  • New SharePoint Server Subscription Edition: The Version 26H1 feature update is included, and future public updates will include it too.
  • Improved Property Pane: When the Property Pane is open, selecting the editor lets users return focus to it.
  • Fix Document web part: Multi-value managed metadata fields can be viewed and edited in the document web part.

  Read update → Source: Microsoft ↗

• SharePoint Server SE SharePoint Server SE Security update

  KB5002863 May 12, 2026

  Remote-code flaws addressed; Quick Edit gains keyboard navigation

  Addresses 9 vulnerabilities, including two critical remote-code execution flaws: CVE-2026-40365 in SharePoint Server and CVE-2026-40367 in Word. It also improves Quick Edit keyboard access and fixes farm-management issues.

  Check the newer update, KB5002873

  Key changes 9 CVEs · 6 changes

  • Improved SPList Quick Edit view: Keyboard navigation reaches column headers in the SPList Quick Edit view.
  • Improved Ingestion: Ingestion throughput improves.
  • Fix SharePoint Server: The update addresses a remote code execution vulnerability in SharePoint Server.

  Read update → Source: Microsoft ↗

• SharePoint Server SE SharePoint Server SE Security update

  Zero-day

  KB5002853 Apr 14, 2026

  An exploited spoofing flaw and publishing-page fixes

  Closes an exploited spoofing vulnerability and fixes several issues, including publishing pages that show the wrong interface and a rich text editor that cannot insert line breaks.

  Check the newer update, KB5002863

  Key changes 2 CVEs · 6 changes

  • Improved Search: Search ingestion processes content faster through a higher cache hit rate.
  • Fix SharePoint Server: The GB18030-2022 certification issue is fixed.
  • Fix Publishing pages: Appending p=2 to a publishing page URL no longer makes the page show a File Picker-style interface instead of the expected page.

  Read update → Source: Microsoft ↗

• SharePoint Server SE SharePoint Server SE Security update

  KB5002843 Mar 10, 2026

  Critical Office code-execution flaw fixed; direct upgrade can fail

  The update fixes three security vulnerabilities, including a critical Office remote-code execution flaw. SharePoint Server Subscription Edition farms moving directly from the January to March update can hit a PSConfig failure.

  Check the newer update, KB5002853

  Known issues: 1 open Organizations and IT administrators

  • For SharePoint Server Subscription Edition customers who are currently on the January 2026 public update, updating directly to the March 2026 public update fails when you run the SharePoint Products Configuration Wizard (PSConfig).

  Key changes 3 CVEs · 5 changes

  • Improved Hybrid Search: Hybrid Search makes fewer redundant onboarding requests and waits 15 minutes between consecutive failures.
  • Improved Hybrid Search: The Hybrid Search onboarding script uses a customer-owned application.
  • Fix Security: The update fixes a critical Office remote-code execution vulnerability and SharePoint Server remote-code execution and spoofing vulnera...

  Read update → Source: Microsoft ↗

• SharePoint Server SE SharePoint Server SE Security update

  KB5002833 Feb 10, 2026

  Word and Outlook spoofing flaws patched; farm issues fixed

  The update fixes two Important spoofing vulnerabilities affecting Word and Outlook, adds the Version 25H2 feature update, and addresses SharePoint farm, workflow, and document-handling problems.

  Check the newer update, KB5002843

  Key changes 2 CVEs · 10 changes

  • New Version 25H2 feature update: The Version 25H2 feature update is included, and future public updates will include it too.
  • Improved People Picker: Configurable access controls can limit the People Picker to authorized users by excluding the Everyone claim.
  • Fix Zero downtime updating: Zero-downtime updating is no longer blocked.

  Read update → Source: Microsoft ↗

• SharePoint Server SE SharePoint Server SE Security update

  KB5002822 Jan 13, 2026

  Eight vulnerabilities addressed as the 25H2 feature update arrives

  The update addresses eight vulnerabilities and introduces the 25H2 feature update. It also fixes SharePoint issues affecting accessibility, content display, and data migration.

  Check the newer update, KB5002833

  Key changes 8 CVEs · 16 changes

  • New SharePoint Server Subscription Edition: The 25H2 feature update is included. Future public updates will also include it.
  • Improved SharePoint Workflow Manager: Farms running SharePoint Workflow Manager need its November update before installing this cumulative update.
  • Improved Classic Workflow Manager: Classic Workflow Manager can continue to be used after its debug flag is enabled.

  Read update → Source: Microsoft ↗

• SharePoint Server SE SharePoint Server SE Security update

  KB5002815 Dec 9, 2025

  Spoofing flaw closed; 25H2 features and workflow fixes added

  The update closes a SharePoint Server spoofing vulnerability and introduces the 25H2 feature update, alongside accessibility, crawling, workflow, search and rendering fixes.

  Check the newer update, KB5002822

  Key changes 1 CVE · 12 changes

  • New SharePoint Server Subscription Edition: The Version 25H2 feature update is introduced and will be included in future public updates.
  • Improved Audit logs: Users must specify the library for storing audit logs before starting the process.
  • Fix SharePoint Server: A spoofing vulnerability in SharePoint Server is fixed.

  Read update → Source: Microsoft ↗

• SharePoint Server SE SharePoint Server SE Security update

  KB5002800 Nov 11, 2025

  Remote code execution flaw closed; 25H2 features arrive

  Closes a SharePoint remote code execution vulnerability and introduces the 25H2 feature update, which will be included in future public updates.

  Check the newer update, KB5002815

  Known issues: 1 open Organizations and IT administrators

  • Users may see “4gab5" event tags logged in the SharePoint Unified Logging System (ULS) logs when they access sitedirectorysettings.aspx by using ‘set other host’.

  Key changes 1 CVE · 4 changes

  • New SharePoint Server Subscription Edition Version 25H2: The Version 25H2 feature update is introduced and will be included in future public updates.
  • Fix SharePoint Server: Closes a remote code execution vulnerability in SharePoint Server.
  • Fix Certificates: The GB18030-2022 certificate issue is fixed.

  Read update → Source: Microsoft ↗

• SharePoint Server SE SharePoint Server SE Security update

  KB5002786 Oct 14, 2025

  Closes two remote-code flaws and adds the 25H2 feature update

  The update closes two Important SharePoint remote code execution vulnerabilities and adds the 25H2 feature update. Farms using 2013-type workflows need the August 2025 Workflow Manager update first.

  Check the newer update, KB5002800

  Key changes 2 CVEs · 9 changes

  • New SharePoint Server Subscription Edition Version 25H2: The 25H2 feature update is included, and future public updates will include it too.
  • Improved LAYOUTS folder permissions: Write permission is denied by default for the WSS_WPG and IIS_IUSRS groups on the LAYOUTS folder, to help resolve update installation i...
  • Improved Classic Workflow Manager: If workflow functionality breaks, you can restore operations by enabling the debug flag and updating the farm.

  Read update → Source: Microsoft ↗

• SharePoint Server SE SharePoint Server SE Security update

  KB5002784 Sep 9, 2025

  Remote code execution flaw resolved; 25H2 feature update arrives

  A SharePoint remote code execution vulnerability, CVE-2025-54897, is resolved. The update also introduces the 25H2 feature update and changes workflow requirements, AMSI defaults, and machine-key rotation.

  Check the newer update, KB5002786

  Key changes 1 CVE · 9 changes

  • New SharePoint Server Subscription Edition: The SharePoint Server Subscription Edition 25H2 feature update is included.
  • New SharePoint Management Shell: You can use a new cmdlet to check that Windows Defender components are installed and active and that SharePoint antimalware scanning is...
  • Improved Workflows: SharePoint workflows now require the latest SharePoint Workflow Manager update.

  Read update → Source: Microsoft ↗

• SharePoint Server SE SharePoint Server SE Security update

  KB5002773 Aug 12, 2025

  Calendar overlay settings may fail; search and list fixes included

  Closes one Important elevation-of-privilege vulnerability (CVE-2025-53760), improves search and list controls, and fixes SharePoint issues. Calendar overlay settings might have problems after installation.

  Check the newer update, KB5002784

  Known issues: 1 open

  • After you install this update, you might experience an issue when you configure calendar overlay settings.

  Key changes 1 CVE · 20 changes

  • New Property pane: A new option lets users hide the command bar in list and document library web parts.
  • Improved People Picker: The People Picker search experience is improved.
  • Improved Hybrid search: New hybrid search performs better.

  Read update → Source: Microsoft ↗

• SharePoint Server SE SharePoint Server SE Out-of-band security update

  Out-of-band Zero-day

  KB5002768 Jul 21, 2025

  Exploited remote-code flaw patched; page resources may fail to load

  Closes a critical SharePoint Server remote-code execution flaw that attackers are exploiting. Some SharePoint page resources might fail to load after installation.

  Check the newer update, KB5002773

  Known issues: 2 open Organizations and IT administrators

  • $farm.ContainsGenericAllowedListValue("SignOutRefererAllowList", "<resource path>")
  • $farm.RemoveGenericAllowedListValue("SignOutRefererAllowList", "<resource path>")

  Key changes 2 CVEs · 2 changes

  • Fix SharePoint Server: Closes a remote code execution vulnerability in SharePoint Server.
  • Fix SharePoint Server: Closes a spoofing vulnerability in SharePoint Server.
  • Exploited CVE-2025-53770: Microsoft SharePoint Server Remote Code Execution Vulnerability

  Read update → Source: Microsoft ↗

• SharePoint Server SE SharePoint Server SE Security update

  KB5002751 Jul 8, 2025

  Remote code execution and spoofing flaws closed; search and RSS fixed

  Closes two Important SharePoint vulnerabilities and fixes search resilience during extended server shutdowns and RSS pages that fail after a .NET Framework 4.8 upgrade.

  Check the newer update, KB5002768

  Key changes 2 CVEs · 3 changes

  • New Hybrid Search: The new Hybrid Search feature is enabled for the Standard release ring.
  • Fix SharePoint search topology: SharePoint search is more resilient during extended server shutdowns, particularly when Crawler components remain active.
  • Fix RSS Feed pages: RSS Feed pages load correctly after an upgrade to .NET Framework 4.8.

  Read update → Source: Microsoft ↗

• SharePoint Server SE SharePoint Server SE Security update

  KB5002736 Jun 10, 2025

  Critical remote-code flaw fixed; Hybrid Search flight remains blocked

  The update fixes three vulnerabilities, including one Critical remote-code execution flaw, CVE-2025-47172. The new Hybrid Search flight still is not enabled in the Standard release ring; support can provide a workaround.

  Check the newer update, KB5002751

  Known issues: 1 open Organizations and IT administrators

  • The flight for the new Hybrid Search feature in the Standard release ring was not enabled successfully in the May update, please contact the support team to get the workaround to enable the flight.

  Key changes 3 CVEs · 12 changes

  • New List web part: A setting lets you hide the command bar in the List web part.
  • Improved Hybrid Search: The update supports a configuration for the hybrid search endpoint; use the latest onboarding script to try this update.
  • Improved Hybrid Search: Customers must use the new hybrid search endpoint.

  Read update → Source: Microsoft ↗

• SharePoint Server SE SharePoint Server SE Security update

  KB5002709 May 13, 2025

  Remote code execution and privilege escalation flaws fixed

  Resolves four Important security vulnerabilities in SharePoint Server, including remote code execution and elevation of privilege flaws. It also adds hybrid search support and fixes four SharePoint issues.

  Check the newer update, KB5002736

  Search Content Service (SCS) is scheduled to retire on June 30, 2025. The page does not say that readers need to take action because of the retirement.

  Key changes 4 CVEs · 7 changes

  • New Hybrid search: A new command supports retrieving the VroomId in hybrid search scenarios.
  • New Hybrid Search: Hybrid Search is scheduled to become available in the Standard release ring. A script onboards the new Hybrid Search Experience process...
  • Improved Search Content Service: Search Content Service (SCS) is scheduled to retire on June 30, 2025.

  Read update → Source: Microsoft ↗

• SharePoint Server SE SharePoint Server SE Security update

  KB5002705 Apr 8, 2025

  Remote code execution flaw closed; authentication checks strengthened

  The update addresses a SharePoint remote code execution vulnerability and strengthens security and validation during authentication.

  Check the newer update, KB5002709

  Key changes 2 CVEs · 2 changes

  • Improved SharePoint Server Subscription Edition: Authentication processes get stronger security and validation checks.
  • Fix SharePoint Server: A remote code execution vulnerability in SharePoint is addressed.
  • CVSS 8.8 CVE-2025-29794: Microsoft SharePoint Remote Code Execution Vulnerability

  Read update → Source: Microsoft ↗

• SharePoint Server SE SharePoint Server SE Security update

  KB5002681 Feb 11, 2025

  Remote code execution flaw closed; four list problems fixed

  The update resolves a SharePoint Server remote code execution vulnerability and fixes four problems with list displays, account validation, and creating list items.

  Check the newer update, KB5002705

  Key changes 1 CVE · 4 changes

  • Fix Computed columns: In modern lists, computed columns show their actual values instead of IDs when the fields are not visible.
  • Fix Information panel: The information panel validates Windows accounts in Person columns when a web application uses multiple authentication modes.
  • Fix Date column: Date columns show the correct value instead of “30.12.1899” when a list contains a column with custom formatting.

  Read update → Source: Microsoft ↗

• SharePoint Server SE SharePoint Server SE Security update

  KB5002676 Jan 14, 2025

  Remote code execution and spoofing flaws addressed; search failures fixed

  The update addresses SharePoint Server remote code execution and spoofing vulnerabilities, and fixes several search, import, and web part problems.

  Check the newer update, KB5002681

  Key changes 3 CVEs · 7 changes

  • Improved Search Content Service (SCS): Hybrid search requests include a User-Agent header.
  • Fix Cross-site collection moves: Users no longer see the unsupported search box for cross-site collection moves.
  • Fix Client-Side Object Model (CSOM): Exporting a document set no longer fails with an EventTrace initializer error.

  Read update → Source: Microsoft ↗

• SharePoint Server SE SharePoint Server SE Security update

  KB5002658 Dec 10, 2024

  Remote code execution and privilege flaws fixed alongside page issues

  The update addresses four Important security vulnerabilities, including remote code execution and elevation of privilege, and fixes four SharePoint page and upload problems.

  Check the newer update, KB5002676

  Key changes 4 CVEs · 4 changes

  • Fix SPSerialization: Pages with third-party web parts or controls load successfully when SPSerialization is restricted using the new allow-list mechanism.
  • Fix Command bar: Command bar elements no longer disappear when you zoom the browser in or out.
  • Fix Folder upload: You can upload folders whose names contain similar characters from the extended range of supported characters.

  Read update → Source: Microsoft ↗

• SharePoint Server SE SharePoint Server SE Security update

  KB5002651 Nov 12, 2024

  Security-related features get defense-in-depth updates

  The update adds defense-in-depth changes to security-related features. It includes one unrated vulnerability; none are listed as critical, publicly disclosed, or exploited.

  Check the newer update, KB5002658

  Key changes 1 CVE · 1 change

  • Improved Security-related features: Security-related features get defense-in-depth updates.
  • Security ADV240001: Microsoft SharePoint Server Defense in Depth Update

  Read update → Source: Microsoft ↗