Updates for SharePoint Server 2016 (April 2023 CU)

16.4.2023    |    komentáře   komentářů: 0

A new cumulative update (April 2023 CU) has been released for SharePoint Server 2016.

This CU includes both Feature Pack 2, available since the September CU (September 2017 CU), and the earlier Feature Pack 1.

SP Build:
16.0.5391.1000 (Language independent CU)
16.0.5391.1000 (Language dependent CU)

SharePoint 2016 CU – KB articles describing the CU:

  • KB 5002385 – April 2023 Update for SharePoint Server 2016 (language independent)
  • KB 5002370 – April 2023 Update for SharePoint Server 2016 (language dependent)

SharePoint Server 2016 CU – CU download links:

After installation, remember to run the SharePoint 2016 Products Configuration Wizard or the following command:

PSConfig.exe -cmd upgrade -inplace b2b -wait -cmd applicationcontent -install -cmd installfeatures -cmd secureresources -cmd services -install

Important notes

Always install both packages in this order:

  1. language independent components (core CU)
  2. language-dependent components (language CU)

For language-dependent packages, the language you select does not matter because each package contains updates for all languages.

If you install a new language pack on a SharePoint Server 2016 farm, you must reinstall the language-dependent update afterwards.

Remember to keep Distributed Cache updated as well as SharePoint. See How to update Distributed Cache correctly (in Czech).

Note for this CU:

KB5002385 requires the release version of SharePoint Enterprise Server 2016; KB5002370 also requires SharePoint Enterprise Server 2016.

Enabling the modern OneDrive for Business experience requires an active Software Assurance contract, whether enabled by this update or manually. Without an active contract at enablement, disable this experience.

KB5002370 may require a computer restart.

On Windows Server 2012 R2, upgrading after both April updates can cause HTTP 503, prevent all SharePoint IIS application pools from starting (including Central Administration and Web Services), and record event 2280 from IIS-W3SVC-WP because the AMSI module cannot load. AMSI is incompatible with this operating system. KB5026765 identifies June 2023 KB5002404 as the fix.

Included fixes and improvements

The following overview summarizes the fixes and improvements in this CU based on the official Microsoft KB articles.

SharePoint Server 2016

KB5002385 addresses SharePoint Server spoofing: CVE-2023-28288.

The core package KB5002385 includes these SharePoint Server changes:

  • Ensures that the farm service account belongs to the database owner group for the Subscription Settings service application database.

  • Fixes an issue where blocked file extensions cause errors when creating or accessing folders and subsites.

The following improvement requires both KB5002370 and KB5002385:

  • Adds Windows Antimalware Scan Interface (AMSI) integration to intercept malicious requests before they reach SharePoint endpoints, including attacks on vulnerabilities whose fixes are not yet installed. See AMSI configuration.

    For this CU, AMSI requires Windows Server 2016 or later and Microsoft Defender engine 1.1.18300.4 or later, or a compatible AMSI-capable provider. Activate it for each web application in Central Administration: Application Management → Manage web applications → select the application → Manage Features → SharePoint Server Antimalware Scanning → Activate.

Komentáře