Updates for SharePoint Server 2019 (August 2025 CU)

17.8.2025    |    komentáře   komentářů: 0

A new cumulative update (August 2025 CU) has been released for SharePoint Server 2019.

SP Build:
16.0.10417.20041 (Language independent CU)
16.0.10417.20041 (Language dependent CU)

SharePoint 2019 CU – KB articles describing the CU:

  • KB 5002769 – August 2025 Update for SharePoint Server 2019 (language independent)
  • KB 5002770 – August 2025 Update for SharePoint Server 2019 (language dependent)

SharePoint Server 2019 CU – CU download links:

After installation, remember to run the SharePoint 2019 Products Configuration Wizard or the following command:

PSConfig.exe -cmd upgrade -inplace b2b -wait -cmd applicationcontent -install -cmd installfeatures -cmd secureresources -cmd services -install

Important notes

Always install both packages in this order:

  1. language independent components (core CU)
  2. language-dependent components (language CU)

For language-dependent packages, the language you select does not matter because each package contains updates for all languages.

If you install a new language pack on a SharePoint Server 2019 farm, you must reinstall the language-dependent update afterwards.

Remember to keep Distributed Cache updated as well as SharePoint. See How to update Distributed Cache correctly (in Czech).

Note for this CU:

KB 5002769 and KB 5002770 require the release version of SharePoint Server 2019 to be installed.

KB 5002769 can cause problems when configuring calendar overlays. See KB5064829.

After an Exchange Web Service URL is configured in Calendar Overlay settings, CalendarService.ashx can report Invalid EWS URL: <url> with ULS tags 583ga or apmev. SharePoint Server allows no Exchange Web Service URLs by default for security. After verifying the blocked URL is safe, a farm administrator can allow its host through AllowedSafeDomain, replacing <host> in the commands below with that host:

add-pssnapin *
$f=get-spfarm
$f.AllowedSafeDomain.Add("<host>")
$f.update()

Included fixes and improvements

The following overview summarizes the fixes and improvements in this CU based on the official Microsoft KB articles.

SharePoint Server 2019

KB 5002769 addresses remote code execution and elevation of privilege in SharePoint, and remote code execution and information disclosure in Microsoft Word. The advisories are CVE-2025-49712, CVE-2025-53760, CVE-2025-53733, CVE-2025-53736.

KB 5002770 addresses remote code execution and information disclosure in Microsoft Word. The advisories are CVE-2025-53733, CVE-2025-53736.

The following improvement and fix require both the language-dependent package KB 5002770 and the language-independent package KB 5002769:

  • Adds a warning when a Cloud Search Service Application (Cloud SSA) is deleted before users have verified removal of its hybrid indexes.

  • Fixes an issue where Business Connectivity Services (BCS) cannot use the DotNetAssembly or WebService system types because they are disabled by default. If you trust your Business Data Connectivity (BDC) models, enable support for models based on these types in the SharePoint Management Shell:

    $farm = Get-SPFarm
$farm.ServerDebugFlags.Add(57007)
$farm.ServerDebugFlags.Add(57008)
$farm.update()
iisreset

Komentáře