Updates for SharePoint Server 2019 (November 2022 CU)

A new cumulative update (November 2022 CU) has been released for SharePoint Server 2019.

SP Build:
16.0.10392.20000 (Language independent CU)
16.0.10392.20000 (Language dependent CU)

SharePoint 2019 CU – KB articles describing the CU:

• KB 5002294 – November 2022 Update for SharePoint Server 2019 (language independent)
• KB 5002295 – November 2022 Update for SharePoint Server 2019 (language dependent)

SharePoint Server 2019 CU – CU download links:

• Download November 2022 Update for SharePoint Server 2019 (language independent)
• Download November 2022 Update for SharePoint Server 2019 (language dependent)

After installation, remember to run the SharePoint 2019 Products Configuration Wizard or the following command:

PSConfig.exe -cmd upgrade -inplace b2b -wait -cmd applicationcontent -install -cmd installfeatures -cmd secureresources -cmd services -install

Important notes

Always install both packages in this order:

1. language independent components (core CU)
2. language-dependent components (language CU)

For language-dependent packages, the language you select does not matter because each package contains updates for all languages.

If you install a new language pack on a SharePoint Server 2019 farm, you must reinstall the language-dependent update afterwards.

Remember to keep Distributed Cache updated as well as SharePoint. See How to update Distributed Cache correctly (in Czech).

Note for this CU:

Installation requires the release version of SharePoint Server 2019.

Access Services is changed to work with newer SQL Server components because its SQL Server 2012 dependencies are no longer supported with SharePoint Server 2019. To keep the feature working and supported, upgrade the following components before installing this CU. Upgrading them afterwards is also possible, but Access Services may stop working until those upgrades are complete.

• Replace Microsoft SQL Server Express 2012 LocalDB with Microsoft SQL Server Express 2016 LocalDB, installer SqlLocalDB.msi.

• Upgrade Microsoft System CLR Types for Microsoft SQL Server 2012 to Microsoft System CLR Types for Microsoft SQL Server 2016 SP3, installer SQLSysClrTypes.msi.

• Upgrade Microsoft SQL Server 2012 Data-Tier Application Framework to Microsoft SQL Server 2016 SP3 Data-Tier Application Framework, installer Dacframework.msi.

• Upgrade Microsoft SQL Server 2012 Transact-SQL ScriptDom to Microsoft SQL Server 2016 SP3 Transact-SQL ScriptDom, installer SQLDOM.MSI.

After installing this CU, Microsoft recommends removing Microsoft SQL Server 2012 Native Client (sqlncli.msi) from SharePoint Server 2019 virtual machines: Access Services no longer uses or supports it. More details are in Access Services Setup for an On-Premise Installation of SharePoint 2016 and 2019; the KB notes that the document title should use On-Premises.

Included fixes and improvements

The following overview summarizes the fixes and improvements in this CU based on the official Microsoft KB articles.

SharePoint Server 2019

• The packages address Word vulnerabilities involving information disclosure and remote code execution: CVE-2022-41060, CVE-2022-41061, CVE-2022-41103.

• The core update also addresses the SharePoint Server remote code execution vulnerability CVE-2022-41062.

The update corrects these SharePoint Server 2019 issues:

• Team-site content could become truncated at 400 percent zoom or after applying text spacing, creating an accessibility problem.

• When a document had no content, SharePoint search language detection did not consider its title.

Both KB 5002295 and KB 5002294 are needed to fully resolve the following issues:

• Modern UI incorrectly allowed the Document ID to be edited.

• On pages containing three or four web parts, the Suite Navigation bar and Quick Launch menu could load slowly.

• In Project Web App (PWA), a project edited on a Project Detail Page (PDP) with a Content Editor web part could remain unchecked in after the page’s security validation expired: closing it and attempting check-in left a persistent Processing notification. The fix instead reports the security-validation timeout and instructs the user to go back in the browser, refresh the page and retry.