A new cumulative update (July 2026 CU) has been released for SharePoint Server Subscription Edition.
SP Build:
16.0.19725.20434
Important before installation:
If you are upgrading from the September 2025 CU to a newer update, remove the NT AUTHORITY\SYSTEM account from the local WSS_WPG and IIS_IUSRS groups on every SharePoint server in the farm before installation, if it is a member. Otherwise, installation of the update may fail.
Starting with the March 2023 CU, updates for SharePoint Server Subscription Edition are released as a single package (known as an Uber package) containing both language-independent and language-dependent fixes. Only one package needs to be installed to fully update the server.
SharePoint Subscription Edition CU – KB articles describing the CU:
- KB 5002882 – July 2026 Update for SharePoint Server Subscription Edition
SharePoint Server Subscription Edition CU – CU download links:
After installation, remember to run the SharePoint Products Configuration Wizard or the following command:
PSConfig.exe -cmd upgrade -inplace b2b -wait -cmd applicationcontent -install -cmd installfeatures -cmd secureresources -cmd services -install
Important notes
To speed up CU installation, I recommend following the guidance in How to speed up CU installation in SharePoint Server Subscription Edition.
The language you select when downloading the update does not matter because the same package is downloaded for every language.
Note for this CU:
KB 5002882: The release version of SharePoint Server Subscription Edition must be installed. Farms running SharePoint Workflow Manager must install KB5002799 before this CU.
To continue using Classic Workflow Manager, enable the debug flag with these commands:
$farm = Get-SPFarm
$farm.ServerDebugFlags.Add(53601)
$farm.update()
iisreset
After running PSConfig, execute the following commands. They disable an additional defense-in-depth feature that is still being developed and can cause a regression. Existing actor token validation remains active:
$farm = Get-SPFarm
$farm.DisableActorTokenAudienceValidation = $true #disables only the defense-in-depth validation
$farm.update()
Farms with multiple front-end servers and Trusted Provider or Forms authentication can repeatedly prompt users to sign in. Windows authentication is unaffected. Sticky sessions on the reverse proxy mitigate most scenarios while Microsoft prepares a subsequent fix. Microsoft advises against disabling SessionCookieTransformProtectionEnabled: doing so removes authentication protection and can expose security vulnerabilities.
Workflow status links can fail on WrkStat.aspx with “The WorkflowInstanceID parameter is invalid.” Follow Microsoft’s workflow status workaround. You can open the document menu, choose More > Workflow, then Internal Status. Alternatively, apply the documented IIS URL Rewrite rule on every WFE serving affected sites; this requires administrator access and IIS URL Rewrite 2.1 on every WFE, otherwise the rule causes HTTP 500.19. Back up web.config before adding the rule. An equivalent rule can also run on a reverse proxy or load balancer. The problem is over-encoding during rendering; stored list data and URLs must not be changed. The rule leaves correctly encoded links unchanged and becomes inactive after the official fix. Saving the configuration recycles the application automatically; no IIS reset is needed. Verify previously failing double- and triple-encoded links and links that already worked.
Included fixes and improvements
The following overview summarizes the fixes and improvements in this CU based on the official Microsoft KB articles.
SharePoint Server Subscription Edition
KB 5002882 addresses information disclosure, remote code execution, spoofing and security feature bypass in SharePoint Server, remote code execution in Word, and elevation of privilege in SharePoint. The advisories are: CVE-2026-55051, CVE-2026-55126, CVE-2026-55050, CVE-2026-55034, CVE-2026-55021, CVE-2026-55020, CVE-2026-56192, CVE-2026-56157, CVE-2026-55135, CVE-2026-55052, CVE-2026-55130, CVE-2026-55128, CVE-2026-55142, CVE-2026-55040, CVE-2026-55134, CVE-2026-55132, CVE-2026-55038, CVE-2026-55055, CVE-2026-55035, CVE-2026-55127, CVE-2026-55124, CVE-2026-55033, CVE-2026-55032, CVE-2026-55045, CVE-2026-55047, CVE-2026-55028, CVE-2026-55027, CVE-2026-55026, CVE-2026-55125, CVE-2026-55030, CVE-2026-55023, CVE-2026-55019, CVE-2026-55016, CVE-2026-50522, CVE-2026-56164, CVE-2026-54108.
The unified package KB 5002882 includes this SharePoint Server Subscription Edition fix:
- Fixes an issue where SharePoint 2010 workflows fail to start after installation of the June 2026 update.