Updates for SharePoint Server 2019 (August 2026 CU)

16.8.2026    |    komentáře   komentářů: 0

A new cumulative update (August 2026 CU) has been released for SharePoint Server 2019.

SP Build:
16.0.10417.20198 (Language independent CU)
16.0.10417.20198 (Language dependent CU)

Important before installation:

If you are upgrading from the September 2025 CU to a newer update, remove the NT AUTHORITY\SYSTEM account from the local WSS_WPG and IIS_IUSRS groups on every SharePoint server in the farm before installation, if it is a member. Otherwise, installation of the update may fail.

SharePoint 2019 CU – KB articles describing the CU:

  • KB 5002894 – August 2026 Update for SharePoint Server 2019 (language independent)
  • KB 5002896 – August 2026 Update for SharePoint Server 2019 (language dependent)

SharePoint Server 2019 CU – CU download links:

After installation, remember to run the SharePoint 2019 Products Configuration Wizard or the following command:

PSConfig.exe -cmd upgrade -inplace b2b -wait -cmd applicationcontent -install -cmd installfeatures -cmd secureresources -cmd services -install

Important notes

Always install both packages in this order:

  1. language independent components (core CU)
  2. language-dependent components (language CU)

For language-dependent packages, the language you select does not matter because each package contains updates for all languages.

If you install a new language pack on a SharePoint Server 2019 farm, you must reinstall the language-dependent update afterwards.

Remember to keep Distributed Cache updated as well as SharePoint. See How to update Distributed Cache correctly (in Czech).

Note for this CU:

KB 5002894: Farms using SharePoint Workflow Manager need KB 5002799 installed before this CU.

KB 5002896: If the farm runs 2013-type workflows, install the August 2025 SharePoint Workflow Manager update before this CU.

To keep using Classic Workflow Manager, enable its debug flag with:

      $farm = Get-SPFarm
      $farm.ServerDebugFlags.Add(53601)
      $farm.update()
      iisreset

The release version of SharePoint Server 2019 must already be installed.

Included fixes and improvements

The following overview summarizes the fixes and improvements in this CU based on the official Microsoft KB articles.

SharePoint Server 2019

KB 5002894 addresses remote code execution, spoofing, tampering and information disclosure in SharePoint Server, plus privilege elevation in SharePoint. The advisories are CVE-2026-63516, CVE-2026-63512, CVE-2026-63514, CVE-2026-62837, CVE-2026-62827, CVE-2026-62829, CVE-2026-57105, CVE-2026-70355, CVE-2026-62917, CVE-2026-62839, CVE-2026-58639, CVE-2026-66808, CVE-2026-66805, CVE-2026-64921, CVE-2026-64916, CVE-2026-64901, CVE-2026-64902, CVE-2026-64900, CVE-2026-64897, CVE-2026-70324, CVE-2026-65665, CVE-2026-65660, CVE-2026-65663, CVE-2026-65658, CVE-2026-64922, CVE-2026-63520.

KB 5002896 addresses tampering, privilege elevation, spoofing and remote code execution in SharePoint Server. Its advisories are CVE-2026-63516, CVE-2026-63512, CVE-2026-63514, CVE-2026-62837, CVE-2026-62827, CVE-2026-62829, CVE-2026-57105, CVE-2026-70355, CVE-2026-62917, CVE-2026-62839, CVE-2026-58639, CVE-2026-66808, CVE-2026-66805, CVE-2026-64921, CVE-2026-64916, CVE-2026-64901, CVE-2026-64902, CVE-2026-64900, CVE-2026-64897, CVE-2026-70324, CVE-2026-65665, CVE-2026-65660, CVE-2026-65663, CVE-2026-65658, CVE-2026-64922, CVE-2026-63520.

Core KB 5002894 and language KB 5002896 list the following nonsecurity fixes and changes; each item identifies its package:

  • KB 5002894: Fixes an issue where workflow status links fail on the WrkStat.aspx page.

  • KB 5002894 and KB 5002896: Warns that orphaned Remote Event Receivers (RERs) without an app identifier may be blocked in the future. Get-SPOrphanedRemoteEventReceiver identifies the affected receivers.

  • KB 5002894 and KB 5002896: Warns that ToolPane may be disabled in the future. Enable-SPToolPane enables it for a site collection.

  • KB 5002894 and KB 5002896: Warns that ExecuteProxyUpdates may be disabled in the future. Use Enable-SPWebPartPagesProxyUpdates to enable it for a site collection, or Disable-SPWebPartPagesProxyUpdates to disable it immediately.

  • KB 5002894: Announces that Exchange autodiscovery for the OWA web part will be disabled starting with the August 2026 Public Update. Enable-SPOWAWebPartAutodiscovery enables this feature for a web application.

  • KB 5002894: Warns that SharePoint 2010 Workflow may be disabled in the future. Enable-SPLegacyWorkflow enables it for a site collection.

  • KB 5002894 and KB 5002896: Turns off file-backed Business Data Connectivity (BDC) model import by default for security. Enable-BdcmFileImport enables the import for a site collection.

Komentáře