Updates for SharePoint Server Subscription Edition (August 2026 CU)

A new cumulative update (August 2026 CU) has been released for SharePoint Server Subscription Edition.

SP Build:
16.0.19725.20522

Starting with the March 2023 CU, updates for SharePoint Server Subscription Edition are released as a single package (known as an Uber package) containing both language-independent and language-dependent fixes. Only one package needs to be installed to fully update the server.

SharePoint Subscription Edition CU – KB articles describing the CU:

• KB 5002893 – August 2026 Update for SharePoint Server Subscription Edition

SharePoint Server Subscription Edition CU – CU download links:

• Download August 2026 Update for SharePoint Server Subscription Edition

After installation, remember to run the SharePoint Products Configuration Wizard or the following command:

PSConfig.exe -cmd upgrade -inplace b2b -wait -cmd applicationcontent -install -cmd installfeatures -cmd secureresources -cmd services -install

Important notes

To speed up CU installation, I recommend following the guidance in How to speed up CU installation in SharePoint Server Subscription Edition.

The language you select when downloading the update does not matter because the same package is downloaded for every language.

Note for this CU:

KB 5002893: The release version of SharePoint Server Subscription Edition must be installed. Farms running SharePoint Workflow Manager must install KB5002799 before this CU.

To continue using Classic Workflow Manager, enable the debug flag with these commands:

$farm = Get-SPFarm
$farm.ServerDebugFlags.Add(53601)
$farm.update()
iisreset

Included fixes and improvements

The following overview summarizes the fixes and improvements in this CU based on the official Microsoft KB articles.

SharePoint Server Subscription Edition

KB 5002893 addresses information disclosure, remote code execution, spoofing and security feature bypass in SharePoint Server, remote code execution in Word, and elevation of privilege in SharePoint. The advisories are: CVE-2026-63520, CVE-2026-63516, CVE-2026-63512, CVE-2026-63514, CVE-2026-62837, CVE-2026-62827, CVE-2026-62829, CVE-2026-57105, CVE-2026-64902, CVE-2026-64900, CVE-2026-64897, CVE-2026-70324, CVE-2026-70321, CVE-2026-65665, CVE-2026-65660, CVE-2026-65663, CVE-2026-65658, CVE-2026-64922, CVE-2026-70355, CVE-2026-62917, CVE-2026-62839, CVE-2026-58639, CVE-2026-70326, CVE-2026-66808, CVE-2026-66805, CVE-2026-64921, CVE-2026-64916, CVE-2026-64901.

The unified package KB 5002893 includes these SharePoint Server Subscription Edition changes:

• Fixes an issue where Distributed Cache (DCache) stops working after installation of the July 2026 Public Update.

• Fixes an issue where workflow status links on WrkStat.aspx are broken.

• Adds an advisory concerning SharePoint 2013 workflows.

• Announces that ExecuteProxyUpdates will be disabled from the September 2026 CU. Use Enable-SPWebPartPagesProxyUpdates to enable it for a site collection, or Disable-SPWebPartPagesProxyUpdates to disable it immediately.

• Announces that orphaned Remote Event Receivers (RERs) without an app identifier will be blocked from the November 2026 Public Update. Identify affected receivers with Get-SPOrphanedRemoteEventReceiver.

• Announces that Exchange autodiscovery in the OWA web part will be disabled from the August 2026 Public Update. Use Enable-SPOWAWebPartAutodiscovery to enable it for a web application.

• Announces that SharePoint 2010 Workflow will be disabled from the September 2026 Public Update. Use Enable-SPLegacyWorkflow to enable it for a site collection.

• Announces that ToolPane will be disabled from the September 2026 Public Update. Use Enable-SPToolPane to enable it for a site collection.

• Disables file-backed Business Data Connectivity (BDC) model import by default for security. Use Enable-BdcmFileImport to enable it for a site collection.