Updates for SharePoint Server 2016 (August 2026 CU)

16.8.2026    |    komentáře   komentářů: 0

A new cumulative update (August 2026 CU) has been released for SharePoint Server 2016.

This CU includes both Feature Pack 2, available since the September CU (September 2017 CU), and the earlier Feature Pack 1.

SP Build:
16.0.5565.1001 (Language independent CU)
16.0.5565.1001 (Language dependent CU)

Important before installation:

If you are upgrading from the September 2025 CU to a newer update, remove the NT AUTHORITY\SYSTEM account from the local WSS_WPG and IIS_IUSRS groups on every SharePoint server in the farm before installation, if it is a member. Otherwise, installation of the update may fail.

SharePoint 2016 CU – KB articles describing the CU:

  • KB 5002905 – August 2026 Update for SharePoint Server 2016 (language independent)
  • KB 5002906 – August 2026 Update for SharePoint Server 2016 (language dependent)

SharePoint Server 2016 CU – CU download links:

After installation, remember to run the SharePoint 2016 Products Configuration Wizard or the following command:

PSConfig.exe -cmd upgrade -inplace b2b -wait -cmd applicationcontent -install -cmd installfeatures -cmd secureresources -cmd services -install

Important notes

Always install both packages in this order:

  1. language independent components (core CU)
  2. language-dependent components (language CU)

For language-dependent packages, the language you select does not matter because each package contains updates for all languages.

If you install a new language pack on a SharePoint Server 2016 farm, you must reinstall the language-dependent update afterwards.

Remember to keep Distributed Cache updated as well as SharePoint. See How to update Distributed Cache correctly (in Czech).

Note for this CU:

KB 5002905 requires farms using SharePoint Workflow Manager to install its update KB5002799 before this CU.

For 2013-type workflows, language-dependent KB 5002906 requires the August 2025 SharePoint Workflow Manager update to be installed first.

To keep using Classic Workflow Manager, enable its debug flag:

      $farm = Get-SPFarm
      $farm.ServerDebugFlags.Add(53601)
      $farm.update()
      iisreset

The release version of SharePoint Server 2016 must already be installed before applying this security update.

Enabling the modern OneDrive for Business experience requires an active Software Assurance contract, whether enabled by the update or manually. If the contract is not active at enablement, turn off this experience.

Included fixes and improvements

The following overview summarizes the fixes and improvements in this CU based on the official Microsoft KB articles.

SharePoint Server 2016

Main package KB 5002905 addresses elevation of privilege, spoofing and tampering in SharePoint Server, information disclosure in Microsoft Office, and remote code execution in SharePoint. Its security advisories are CVE-2026-64897, CVE-2026-70324, CVE-2026-65660, CVE-2026-65663, CVE-2026-65658, CVE-2026-64922, CVE-2026-63520, CVE-2026-63516, CVE-2026-63512, CVE-2026-63514, CVE-2026-62837, CVE-2026-62827, CVE-2026-62917, CVE-2026-62839, CVE-2026-58639, CVE-2026-66808, CVE-2026-66805, CVE-2026-64921, CVE-2026-64916, CVE-2026-64901, CVE-2026-64902, CVE-2026-64900.

Language-dependent KB 5002906 addresses remote code execution in Microsoft Office and spoofing, elevation of privilege, tampering and information disclosure in SharePoint Server. It lists these security advisories: CVE-2026-64897, CVE-2026-70324, CVE-2026-65660, CVE-2026-65663, CVE-2026-65658, CVE-2026-64922, CVE-2026-63520, CVE-2026-63516, CVE-2026-63512, CVE-2026-63514, CVE-2026-62837, CVE-2026-62827, CVE-2026-62917, CVE-2026-62839, CVE-2026-58639, CVE-2026-66808, CVE-2026-66805, CVE-2026-64921, CVE-2026-64916, CVE-2026-64901, CVE-2026-64902, CVE-2026-64900.

The following changes are included in main package KB 5002905. Language-dependent KB 5002906 also includes the BDC import change and the notifications concerning SharePoint 2010/2013 workflows, orphaned RERs, ToolPane and ExecuteProxyUpdates:

  • Fixes an issue where workflow status links fail on the WrkStat.aspx page.

  • Fixes an issue where Distributed Cache (DCache) stops working after the July 2026 Public Update is installed.

  • Adds an advisory concerning SharePoint 2013 workflows.

  • Adds notice that orphaned Remote Event Receivers (RERs) without an app identifier might be disabled in the future. Identify affected RERs with Get-SPOrphanedRemoteEventReceiver.

  • Adds notice that ToolPane might be disabled in the future. Enable it for a site collection with Enable-SPToolPane.

  • Adds notice that ExecuteProxyUpdates might be disabled in the future. Enable it for a site collection with Enable-SPWebPartPagesProxyUpdates, or disable it immediately with Disable-SPWebPartPagesProxyUpdates.

  • Announces that Exchange autodiscovery for the OWA web part is disabled starting with the August 2026 Public Update. Enable it for a web application with Enable-SPOWAWebPartAutodiscovery.

  • Adds notice that SharePoint 2010 Workflow might be disabled in the future. Enable it for a site collection with Enable-SPLegacyWorkflow.

  • Disables importing file-backed Business Data Connectivity (BDC) models by default as a security measure. Enable this capability for a site collection with Enable-BdcmFileImport.

  • Fixes an issue where Office Online Server cannot render or edit documents after the July 2026 Public Update is installed.

Komentáře jsou uzavřeny.