Updates for SharePoint Server 2016 (November 2025 CU)

16.11.2025    |    komentáře   komentářů: 0

A new cumulative update (November 2025 CU) has been released for SharePoint Server 2016.

This CU includes both Feature Pack 2, available since the September CU (September 2017 CU), and the earlier Feature Pack 1.

SP Build:
16.0.5526.1001 (Language independent CU)

Important before installation:

If you are upgrading from the September 2025 CU to a newer update, remove the NT AUTHORITY\SYSTEM account from the local WSS_WPG and IIS_IUSRS groups on every SharePoint server in the farm before installation, if it is a member. Otherwise, installation of the update may fail.

SharePoint 2016 CU – KB articles describing the CU:

  • KB 5002805 – November 2025 Update for SharePoint Server 2016 (language independent)
  • No new language-dependent package was released for this CU. Use the latest available language CU: KB 5002787 (October 2025 CU).

SharePoint Server 2016 CU – CU download links:

After installation, remember to run the SharePoint 2016 Products Configuration Wizard or the following command:

PSConfig.exe -cmd upgrade -inplace b2b -wait -cmd applicationcontent -install -cmd installfeatures -cmd secureresources -cmd services -install

Important notes

Always install both packages in this order:

  1. language independent components (core CU for this release)
  2. language-dependent components (latest available language CU: KB 5002787, October 2025 CU)

For language-dependent packages, the language you select does not matter because each package contains updates for all languages.

If you install a new language pack on a SharePoint Server 2016 farm, you must reinstall the language-dependent update afterwards.

Remember to keep Distributed Cache updated as well as SharePoint. See How to update Distributed Cache correctly (in Czech).

Note for this CU:

If your farm uses SharePoint Workflow Manager, install its update KB5002799 before installing this CU.

To keep using Classic Workflow Manager, enable its debug flag with the following commands:

$farm = Get-SPFarm
$farm.ServerDebugFlags.Add(53601)
$farm.update()
iisreset

The release version of SharePoint Server 2016 must already be installed before applying this security update.

Enabling the modern OneDrive for Business experience requires an active Software Assurance contract, whether it is enabled by installing the update or manually. If the contract is not active at that time, turn off this experience.

Accessing sitedirectorysettings.aspx with “set other host” may produce the 4gab5 event tag in ULS logs. Enhanced security limits access to the current farm host. A farm administrator can allow the additional domain through AdditionalValidSPFarmHosts with the commands below. Verify that the host is safe before adding it.

add-pssnapin *
$f = get-spfarm
$f.AddGenericAllowedListValue("AdditionalValidSPFarmHosts", "your_additional_farm_host")
$f.update()
iisreset

Included fixes and improvements

The following overview summarizes the fixes and improvements in this CU based on the official Microsoft KB articles.

SharePoint Server 2016

KB 5002805 closes a remote code execution vulnerability in Microsoft SharePoint: CVE-2025-62204.

The following change is included in the main package, KB 5002805:

  • Removes the deny permission for Write from the WSS_WPG and IIS_IUSRS groups, preventing the resulting failures when installing later updates.

Komentáře