Updates for SharePoint Server 2016 (July 2026 CU)

A new cumulative update (July 2026 CU) has been released for SharePoint Server 2016.

This CU includes both Feature Pack 2, available since the September CU (September 2017 CU), and the earlier Feature Pack 1.

SP Build:
16.0.5561.1001 (Language independent CU)
16.0.5561.1001 (Language dependent CU)

SharePoint 2016 CU – KB articles describing the CU:

• KB 5002891 – July 2026 Update for SharePoint Server 2016 (language independent)
• KB 5002892 – July 2026 Update for SharePoint Server 2016 (language dependent)

SharePoint Server 2016 CU – CU download links:

• Download July 2026 Update for SharePoint Server 2016 (language independent)
• Download July 2026 Update for SharePoint Server 2016 (language dependent)

After installation, remember to run the SharePoint 2016 Products Configuration Wizard or the following command:

PSConfig.exe -cmd upgrade -inplace b2b -wait -cmd applicationcontent -install -cmd installfeatures -cmd secureresources -cmd services -install

Important notes

Always install both packages in this order:

1. language independent components (core CU)
2. language-dependent components (language CU)

For language-dependent packages, the language you select does not matter because each package contains updates for all languages.

If you install a new language pack on a SharePoint Server 2016 farm, you must reinstall the language-dependent update afterwards.

Remember to keep Distributed Cache updated as well as SharePoint. See How to update Distributed Cache correctly (in Czech).

Note for this CU:

KB 5002891 requires farms using SharePoint Workflow Manager to install its update KB5002799 before this CU.

For 2013-type workflows, language-dependent KB 5002892 requires the August 2025 SharePoint Workflow Manager update to be installed first.

To keep using Classic Workflow Manager, enable its debug flag:

      $farm = Get-SPFarm
      $farm.ServerDebugFlags.Add(53601)
      $farm.update()
      iisreset

The release version of SharePoint Server 2016 must already be installed before applying this security update.

Enabling the modern OneDrive for Business experience requires an active Software Assurance contract, whether enabled by the update or manually. If the contract is not active at enablement, turn off this experience.

Farms with multiple front-end servers using Trusted Provider or Forms authentication may repeatedly request authentication or require multiple sign-ins. Windows authentication farms should be unaffected. Sticky sessions on the reverse proxy mitigate most scenarios while Microsoft prepares a later fix. Microsoft advises against disabling SessionCookieTransformProtectionEnabled: it protects authentication, and disabling it can expose the farm to vulnerabilities.

Opening a workflow status link can make WrkStat.aspx report “The WorkflowInstanceID parameter is invalid.” Use the Microsoft workaround described below.

Excess encoding of WorkflowInstanceID occurs during rendering, leaving stored data intact. Use the document menu: Menu → More → Workflow → Internal Status. Alternatively, on each affected WFE, with administrator access and IIS URL Rewrite 2.1 installed, back up the content web application’s web.config. Without the module, the rule causes HTTP 500.19. Insert the following block into <system.webServer>; if <rewrite> exists, add only <rule> to <rules>. Save; automatic application recycling means no IIS reset is needed.

<rewrite> 
  <rules> 
    <rule name="Fix over-encoded WrkStat WorkflowInstanceID" stopProcessing="true"> 
      <match url="^(.*)(_layouts/15/WrkStat\.aspx)$" ignoreCase="true" /> 
      <conditions logicalGrouping="MatchAll" trackAllCaptures="false"> 
        <add input="{QUERY_STRING}" 
             pattern="^(.*)(List|WorkflowInstanceID)=%(?:25)+7b([0-9A-Fa-f]{8})%(?:25)+2d([0-9A-Fa-f]{4})%(?:25)+2d([0-9A-Fa-f]{4})%(?:25)+2d([0-9A-Fa-f]{4})%(?:25)+2d([0-9A-Fa-f]{12})%(?:25)+7d(.*)$" /> 
      </conditions> 
      <action type="Rewrite" 
              url="{R:0}?{C:1}{C:2}=%7b{C:3}%2d{C:4}%2d{C:5}%2d{C:6}%2d{C:7}%7d{C:8}" 
              appendQueryString="false" /> 
    </rule> 
  </rules> 
</rewrite> 

Test previously failing and working links, including double and triple encoding. Correct links remain unchanged, including after the permanent fix. Do not edit stored URLs. An equivalent reverse-proxy or load-balancer rule is another option.

After the SharePoint 2016 July update, Office Online Server may be unable to render or edit documents. Register the public part of the farm’s STS signing certificate as a trusted token issuer, then recycle IIS on every SharePoint server. Export only the public certificate, without its private key, and verify the private key is absent:

# Get STS certificate 
$stsm = Get-SPSecurityTokenServiceConfig
$live = $stsm.LocalLoginProvider.SigningCertificate

# Export public certificate only (without private key)
$bytes = $live.Export("Cert")
$tempFile = "$env:TEMP\STS_Public.cer"
Set-Content -Path $tempFile -Value $bytes -Encoding Byte

# Load public certificate
$pub = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2($tempFile)

# Verify it does NOT contain private key
$pub.HasPrivateKey

# Get realm
$realm = $stsm.NameIdentifier

# Create trusted issuer
  New-SPTrustedSecurityTokenIssuer `
    -Name "LocalSelfIssuerWopiFix" `
    -Description "Re-trust farm self-issuer after July PU" `
    -Certificate $pub `
    -RegisteredIssuerName $realm

# IIS Reset on all SharePoint servers
  iisreset

Included fixes and improvements

The following overview summarizes the fixes and improvements in this CU based on the official Microsoft KB articles.

SharePoint Server 2016

Main package KB 5002891 addresses elevation of privilege and spoofing in SharePoint Server, information disclosure in Microsoft Office, and remote code execution in SharePoint. Its security advisories are CVE-2026-55134, CVE-2026-55051, CVE-2026-55126, CVE-2026-55032, CVE-2026-55027, CVE-2026-55034, CVE-2026-55021, CVE-2026-55020, CVE-2026-58277, CVE-2026-56192, CVE-2026-56157, CVE-2026-55030, CVE-2026-55023, CVE-2026-55019, CVE-2026-55016, CVE-2026-50522, CVE-2026-56164, CVE-2026-54108, CVE-2026-55124, CVE-2026-55033, CVE-2026-55050, CVE-2026-55045, CVE-2026-55047, CVE-2026-55028, CVE-2026-55026, CVE-2026-55135, CVE-2026-55052, CVE-2026-55130, CVE-2026-55128, CVE-2026-55142, CVE-2026-55040, CVE-2026-55132, CVE-2026-55038, CVE-2026-55055, CVE-2026-55035, CVE-2026-55127.

Language-dependent KB 5002892 addresses remote code execution in Microsoft Office and information disclosure in Microsoft Word: CVE-2026-55035, CVE-2026-55127, CVE-2026-55124, CVE-2026-55033, CVE-2026-55050, CVE-2026-55045, CVE-2026-55047, CVE-2026-55028, CVE-2026-55026, CVE-2026-55125, CVE-2026-55134, CVE-2026-55032, CVE-2026-55027, CVE-2026-56192, CVE-2026-55130, CVE-2026-55128, CVE-2026-55142, CVE-2026-55132, CVE-2026-55038, CVE-2026-55055, CVE-2026-55023.

Main package KB 5002891 also includes this fix:

• Fixes an issue where installing the June 2026 update prevents SharePoint 2010 workflows from starting.