Updates for SharePoint Server 2019 (July 2026 CU)

A new cumulative update (July 2026 CU) has been released for SharePoint Server 2019.

SP Build:
16.0.10417.20175 (Language independent CU)
16.0.10417.20175 (Language dependent CU)

SharePoint 2019 CU – KB articles describing the CU:

• KB 5002883 – July 2026 Update for SharePoint Server 2019 (language independent)
• KB 5002885 – July 2026 Update for SharePoint Server 2019 (language dependent)

SharePoint Server 2019 CU – CU download links:

• Download July 2026 Update for SharePoint Server 2019 (language independent)
• Download July 2026 Update for SharePoint Server 2019 (language dependent)

After installation, remember to run the SharePoint 2019 Products Configuration Wizard or the following command:

PSConfig.exe -cmd upgrade -inplace b2b -wait -cmd applicationcontent -install -cmd installfeatures -cmd secureresources -cmd services -install

Important notes

Always install both packages in this order:

1. language independent components (core CU)
2. language-dependent components (language CU)

For language-dependent packages, the language you select does not matter because each package contains updates for all languages.

If you install a new language pack on a SharePoint Server 2019 farm, you must reinstall the language-dependent update afterwards.

Remember to keep Distributed Cache updated as well as SharePoint. See How to update Distributed Cache correctly (in Czech).

Note for this CU:

KB 5002883: Farms using SharePoint Workflow Manager need KB 5002799 installed before this CU.

KB 5002885: If the farm runs 2013-type workflows, install the August 2025 SharePoint Workflow Manager update before this CU.

To keep using Classic Workflow Manager, enable its debug flag with:

      $farm = Get-SPFarm
      $farm.ServerDebugFlags.Add(53601)
      $farm.update()
      iisreset

The release version of SharePoint Server 2019 must already be installed.

KB 5002883: Multi-front-end farms using Trusted Provider or Forms authentication may repeatedly prompt for credentials or require several sign-ins. Windows authentication farms should be unaffected. Sticky sessions on the reverse proxy mitigate most scenarios; Microsoft is preparing a fix for a subsequent product update. Microsoft advises against disabling SessionCookieTransformProtectionEnabled: although it may seem to help, it removes an authentication safeguard and can expose the farm to vulnerabilities.

KB 5002883: Selecting a workflow status link can make WrkStat.aspx report The WorkflowInstanceID parameter is invalid. Microsoft provides a workaround for workflow status links.

The workaround instructions explain that WorkflowInstanceID is over-encoded during rendering, with % becoming %25 or %2525; stored list data is intact and must not be manually rewritten. A permanent fix is planned. As one option, open the document menu and select More > Workflow > Internal Status. Alternatively, use the supplied IIS URL Rewrite rule on every WFE serving affected sites, or an equivalent rule on a reverse proxy or load balancer. The WFE procedure requires administrator access and IIS URL Rewrite 2.1 on every WFE; adding the rule without the module causes HTTP 500.19. Back up the content web application’s web.config, then insert the supplied <rewrite> block under <system.webServer>; if rewriting is already configured, add only its <rule> to <rules>. Save the file; SharePoint recycles the application automatically, so no IIS reset is needed. Check that previously failing links, including double- and triple-encoded links, now open, and that working links still work. The rule changes requests only, leaves stored data and correctly encoded links alone, and becomes inactive once the official fix produces correct links.

Included fixes and improvements

The following overview summarizes the fixes and improvements in this CU based on the official Microsoft KB articles.

SharePoint Server 2019

KB 5002883 addresses remote code execution and information disclosure in Word, spoofing in SharePoint Server, and privilege elevation in SharePoint. Its distinct advisories are CVE-2026-55051, CVE-2026-55126, CVE-2026-55032, CVE-2026-55027, CVE-2026-55034, CVE-2026-55021, CVE-2026-55020, CVE-2026-58277, CVE-2026-56192, CVE-2026-56157, CVE-2026-55135, CVE-2026-55023, CVE-2026-55019, CVE-2026-55016, CVE-2026-50522, CVE-2026-56164, CVE-2026-54108, CVE-2026-55127, CVE-2026-55124, CVE-2026-55033, CVE-2026-55050, CVE-2026-55045, CVE-2026-55047, CVE-2026-55028, CVE-2026-55026, CVE-2026-55125, CVE-2026-55030, CVE-2026-55052, CVE-2026-55130, CVE-2026-55128, CVE-2026-55142, CVE-2026-55040, CVE-2026-55134, CVE-2026-55132, CVE-2026-55038, CVE-2026-55055, CVE-2026-55035.

KB 5002885 addresses remote code execution and information disclosure in Office and Word. Its distinct advisories are CVE-2026-55032, CVE-2026-55027, CVE-2026-56192, CVE-2026-55130, CVE-2026-55128, CVE-2026-55142, CVE-2026-55134, CVE-2026-55132, CVE-2026-55038, CVE-2026-55055, CVE-2026-55035, CVE-2026-55127, CVE-2026-55124, CVE-2026-55033, CVE-2026-55050, CVE-2026-55045, CVE-2026-55047, CVE-2026-55028, CVE-2026-55026, CVE-2026-55125, CVE-2026-55023.

The language independent package KB 5002883 includes these nonsecurity fixes:

• Fixes an issue where pages fail to load after some user controls are classified as unsafe. After installation, the affected controls can be explicitly trusted through the custom farm property AllowedTagPrefixesWhichAreNotWebControlsList.

• Fixes an issue where installing the June 2026 update prevents SharePoint 2010 workflows from starting.