Updates for SharePoint Server Subscription Edition (October 2026 CU)

Announcements

A new cumulative update (October 2026 CU) has been released for SharePoint Server Subscription Edition.

SP Build:
16.0.20326.20190

Important before installation:

If you are upgrading from the September 2025 CU to a newer update, remove the NT AUTHORITY\SYSTEM account from the local WSS_WPG and IIS_IUSRS groups on every SharePoint server in the farm before installation, if it is a member. Otherwise, installation of the update may fail.

Starting with the March 2023 CU, updates for SharePoint Server Subscription Edition are released as a single package (known as an Uber package) containing both language-independent and language-dependent fixes. Only one package needs to be installed to fully update the server.

SharePoint Subscription Edition CU – KB articles describing the CU:

  • KB 5002927 – October 2026 Update for SharePoint Server Subscription Edition

SharePoint Server Subscription Edition CU – CU download links:

After installation, remember to run the SharePoint Products Configuration Wizard or the following command:

PSConfig.exe -cmd upgrade -inplace b2b -wait -cmd applicationcontent -install -cmd installfeatures -cmd secureresources -cmd services -install

Important notes

To speed up CU installation, I recommend following the guidance in How to speed up CU installation in SharePoint Server Subscription Edition.

The language you select when downloading the update does not matter because the same package is downloaded for every language.

Note for this CU:

If your farm uses SharePoint Workflow Manager, install KB5002799 before this CU.

To continue using the Classic version of Workflow Manager, enable the debug flag with the following commands:

       $farm = Get-SPFarm
       $farm.ServerDebugFlags.Add(53601)
       $farm.update()
       iisreset

This update requires the release version of SharePoint Server Subscription Edition to be installed.

Installing KB5002799 requires SharePoint Workflow Manager Client (16.0.19127.20336). Remove the old client from all servers in both the Workflow Manager and SharePoint Server farms, and install the new client on those servers. Install KB5002799 on every Workflow Manager farm server. For an existing farm, restart the computer if needed and run Upgrade Workflow Manager Farm in the Workflow Manager Configuration Wizard. For a new farm, install SharePoint Workflow Manager RTM, the client and KB5002799, then create the farm with the configuration wizard.

Included fixes and improvements

The following overview summarizes the fixes and improvements in this CU based on the official Microsoft KB articles.

SharePoint Server Subscription Edition

This security update addresses information disclosure, remote code execution, spoofing, security feature bypass and elevation of privilege vulnerabilities in SharePoint, as well as remote code execution in Microsoft Word. The associated security advisories are listed below.

KB5002927 provides the following features, improvements and nonsecurity fixes for SharePoint Server Subscription Edition:

  • Introduces the Version 26H2 feature update, which will also be included in subsequent public updates. See new and improved features in Version 26H2.

  • Fixes an issue where Distributed Cache (DCache) stops working after installation of the July 2026 Public Update.

  • Improves image selection accessibility. In the image picker’s Recent section, screen readers announce the image name instead of identifying it as a bullet link.

  • Fixes issues affecting PSConfig.

  • Disables the ImportWeb SOAP feature starting with the October 2026 CU. To enable it for a site collection, use Enable-SPImportWeb -Identity [Site ID or URL]. To list site collections where it is enabled, use Get-SPImportWebEnabledSites. Microsoft recommends disabling the feature when it is no longer needed by using Disable-SPImportWeb -Identity [Site ID or URL].