Updates for SharePoint Server 2016 (September 2025 CU)

14.9.2025    |    komentáře   komentářů: 0

A new cumulative update (September 2025 CU) has been released for SharePoint Server 2016.

This CU includes both Feature Pack 2, available since the September CU (September 2017 CU), and the earlier Feature Pack 1.

SP Build:
16.0.5517.1000 (Language independent CU)
16.0.5517.1000 (Language dependent CU)

SharePoint 2016 CU – KB articles describing the CU:

  • KB 5002778 – September 2025 Update for SharePoint Server 2016 (language independent)
  • KB 5002777 – September 2025 Update for SharePoint Server 2016 (language dependent)

SharePoint Server 2016 CU – CU download links:

After installation, remember to run the SharePoint 2016 Products Configuration Wizard or the following command:

PSConfig.exe -cmd upgrade -inplace b2b -wait -cmd applicationcontent -install -cmd installfeatures -cmd secureresources -cmd services -install

Important notes

Always install both packages in this order:

  1. language independent components (core CU)
  2. language-dependent components (language CU)

For language-dependent packages, the language you select does not matter because each package contains updates for all languages.

If you install a new language pack on a SharePoint Server 2016 farm, you must reinstall the language-dependent update afterwards.

Remember to keep Distributed Cache updated as well as SharePoint. See How to update Distributed Cache correctly (in Czech).

Note for this CU:

KB5002778 and KB5002777 require the release version of SharePoint Server 2016.

Enabling the modern OneDrive for Business experience requires an active Software Assurance contract, whether enabled by this update or manually. Without an active contract at enablement, disable this experience.

Before installing this CU on a farm using 2013-style workflows, install the August 2025 SharePoint Workflow Manager patch. If the farm uses classic Workflow Manager, upgrade to the latest SharePoint Workflow Manager build. Workflows now require the latest SharePoint Workflow Manager update.

From the September 2025 Public Update, AMSI integration is mandatory and can no longer be deactivated.

Included fixes and improvements

The following overview summarizes the fixes and improvements in this CU based on the official Microsoft KB articles.

SharePoint Server 2016

KB5002778 addresses SharePoint remote code execution, Word information disclosure and Office remote code execution: CVE-2025-54906, CVE-2025-54905, CVE-2025-54897.

Language-dependent KB5002777 addresses Word information disclosure: CVE-2025-54905.

The core package KB5002778 includes these SharePoint Server changes:

  • Adds Test-DefenderAndAmsiWorkProperly in SharePoint Management Shell to check that every Windows Defender component is installed and active and that SharePoint AMSI integration works correctly.

  • Restricts members of WSS_WPG from running administrative processes, including the SharePoint Products Configuration Wizard (Psconfig). See account permissions.

  • Enables automatic machine key rotation.

  • Enhances the AMSI Filter module and changes its default to always on.

Komentáře