A new cumulative update (September 2024 CU) has been released for SharePoint Server Subscription Edition.
SP Build:
16.0.17928.20086
Starting with the March 2023 CU, updates for SharePoint Server Subscription Edition are released as a single package (known as an Uber package) containing both language-independent and language-dependent fixes. Only one package needs to be installed to fully update the server.
SharePoint Subscription Edition CU – KB articles describing the CU:
- KB 5002640 – September 2024 Update for SharePoint Server Subscription Edition
SharePoint Server Subscription Edition CU – CU download links:
After installation, remember to run the SharePoint Products Configuration Wizard or the following command:
PSConfig.exe -cmd upgrade -inplace b2b -wait -cmd applicationcontent -install -cmd installfeatures -cmd secureresources -cmd services -install
Important notes
To speed up CU installation, I recommend following the guidance in How to speed up CU installation in SharePoint Server Subscription Edition.
The language you select when downloading the update does not matter because the same package is downloaded for every language.
Note for this CU:
Installing this update requires the release version of SharePoint Server Subscription Edition.
Custom types inheriting from IDictionary may be blocked during deserialization because they are absent from the allow list. ULS events 4nsby or 4nss4 identify the affected type and assembly. If this occurs in w3wp.exe, a farm administrator may allow only types confirmed safe by adding an AllowedItem named AllowedIDictionaryType with a Type or Assembly property under configuration/SharePoint/SafeMode/AllowedListItems in Web.config. See KB5043462.
Workflow publication can fail when an unauthorized type is blocked. Find ULS event c42q0 to identify it. Only after verifying that both the type and assembly are safe, authorize the type in Web.config under System.Workflow.ComponentModel.WorkflowCompiler, authorizedTypes, and targetFx with version="v4.0". Microsoft’s example entry is:
<authorizedType Assembly="Microsoft.SharePoint.WorkflowActions, Version=16.0.0.0, Culture=neutral, PublicKeyToken=null" Namespace="Microsoft.SharePoint.WorkflowActions.WithKey" TypeName="*" Authorized="True" />
Basic authentication should continue to work for existing web applications, but Central Administration and PowerShell can no longer configure it for either new or existing web applications. This intentional change is part of its deprecation.
Included fixes and improvements
The following overview summarizes the fixes and improvements in this CU based on the official Microsoft KB articles.
SharePoint Server Subscription Edition
This CU addresses remote code execution and denial of service vulnerabilities: CVE-2024-38018, CVE-2024-38227, CVE-2024-38228, CVE-2024-43464, CVE-2024-43466.
The unified update in KB 5002640 includes these SharePoint Server Subscription Edition changes:
-
Adds the Version 24H2 feature update, which is also included in subsequent SPSE public updates.
-
Improves logging of invalid URL field schemas.
-
Fixes an issue where a lookup column using a date-time source displays incorrect data when the view also contains a JSON-formatted column.
-
Fixes an issue where recent .NET cumulative updates disrupt Business Data Connectivity (BDC) features.
-
Fixes an issue where My Site repeatedly requests authentication when the user lacks permissions to followed sites.
-
Fixes an issue where a list view grouped by a required field loses its grouping in page navigation mode.
-
Fixes an issue where the list web part shows incorrect user values for a multivalue user column.
-
Fixes excessive CPU usage during search processing.