October 2025 CU for SharePoint Server 2016 is available for download

Important: If September 2025 CU for SharePoint has been installed before, remove the NT Authority\system account from WSS_WPG and IIS_IUSRS local security groups of the SharePoint machines – otherwise installing the SharePoint fixes will fail.

For more details check this article: Trending Issue: SharePoint fixes fail to install after installation of September 2025 CU

The product group released the October 2025 Cumulative Update for SharePoint Server 2016 product family.

This CU also includes Feature Pack 1 which was released with December 2016 CU and Feature Pack 2 which was released with September 2017 CU.

The KB articles for October 2025 CU should be available at the following locations in a couple of hours:

  • KB 5002788 – October 2025 Update for SharePoint Server 2016 (language independent)
    This is also a security update!
  • KB 5002787 – October 2025 Update for SharePoint Server 2016 (language dependent)
    This is also a security update!

The downloads for October 2025 CU are available through the following links:

Important: It is required to install both fixes (language dependent and independent) to fully patch a SharePoint server. This applies also to servers which do not have language packs installed. The reason is that each SharePoint installation includes a language dependent component together with a language independent component. If additional language packs are added later (only) the language dependent fix has to be applied again.

It is irrelevant which language you pick on the drop down in download center. Even the language dependent fixes are all in the same package for all languages.

After installing the fixes you need to run the SharePoint 2016 Products Configuration Wizard on each machine in the farm. If you prefer to run the command line version psconfig.exe ensure to have a look here for the correct options.

 
SharePoint 2016 October 2025 CU Build Numbers:

Language independent fix: 16.0.5522.1000
Language dependent fix: 16.0.5522.1000

 
To understand the different version numbers please have a look at my article which explains the different SharePoint build numbers.

Please ensure to have a look at the SharePoint Patching Best Practices before applying new fixes.

Related Links:

19 Comments


  1. Hello

    We installed July Kbs in our 2016 farm.
    Now we are planning to install October patch.

    Step1: -As per MS …If you’re running 2013-type workflows, you must install the August 2025 update for SharePoint Workflow Manager to your farm before you install this cumulative update.

    Step2: -If you’re currently running the Classic version of Workflow Manager, you must enable the debug flag to continue using it:

    $farm = Get-SPFarm
    $farm.ServerDebugFlags.Add(53601)
    $farm.update()
    iisreset

    My question is how we Know which workflow running in farm.

    Reply

    1. Hi Ram,

      please check which software is installed on your WFM server.
      It is either Microsoft Workflow Manager (the classic one) or SharePoint Workflow Manager.

      Cheers,
      Stefan

      Reply

  2. In October 2025, CU is also getting same workflow message

    Reply

  3. Hi Stefan

    First of all, thanks for your amazing work on this blog and in regards to Sharepoint as a whole.

    I have a question I hope you can find the time to answer.

    Our environment is a 2016 on-prem, most recent CU is the July one. I was very hesitant to update to the September CU because of the issues introduced, and ended up waiting for the October CU which seems to have fixed most of the issues.

    Leading to my question:
    I remember you had all the issues listed in the same post – I can’t seem to find that post now, but are all of the issues that were introduced with the September CU fixed in the October CU?

    Specifically: Can I go from July to October CU without needing to do anything out of the ordinary?

    Best regards,
    Andy

    Reply

      1. Thanks for the very quick response – that sounds great!

        That is indeed the post I was referring to, and thanks for providing me with the link.

        Best regards,
        Andy

        Reply

      2. Just to clarify,
        I dont need to pay attention to which users are in the wss_wpg and iis_iusrs when going from July CU to October CU?

        Best regards,
        Andy

        Reply

        1. Yes, this is correct.

          Reply

  4. Hi Stefan. After install the SharePoint CU today, all of the Central Admin errors cleared except for 4. For some reason, when I installed September and removed the local accounts, there were initially 4 individual servers with the error message and another error for 4 more servers. The next day (maybe after I re-removed the local accounts), 2 of the individual servers were added to the group + another new server (making 7 in the group). The 3rd day, another one joined the group (making 8). The 4th day, another joined the group (making 9). So, before the patch, I had 1 error message with 9 servers (2 APPs, 3 of 4 WFEs, 4 of 4 SRCH) and 4 individual error messages for 4 servers). After today’s patch, the 4 original errors still remain “Verify various user groups don’t have elevated permissions” (It’s for 2 APP servers, 1 of 4 WFEs, and 1 of 4 SRCH servers). The group of 9 servers cleared.
    Any thoughts? Maybe it will take them 4 days to totally clear. LOL

    Reply

    1. Hi Marlene,
      these health rule messages are a known issue in September and October CU.
      The root cause is known and our product group is currently working on a fix.
      Cheers,
      Stefan

      Reply

  5. Hi Stefan,

    I have a SP2016 Farm with two servers. Last Month September CU was installed, everything works fine. Now I wanted to install the October CU. I removed the System Account from the WSS_WPG Group, in the IIS_IUSRS Group the User was not present. Afterwords I tried to install the CU file, but the installation stuck on the installation without any progress.

    For me it is not possible to start any of these:
    – Central Administration
    – Product and Configuration Wizard
    – Any Web Application
    – Sharepoint Management Shell

    What could be the problem for this?

    Best regards
    Stefan

    Reply

    1. Hi Stefan,
      if the installer got stuck, the most likely a mix of file versions exists on the server.
      Please try to run the installation again. If it fails again it might require to rebuild the server.
      After all the installation file of SharePoint need to be consistent and all belong to the same patch level.
      Cheers,
      Stefan

      Reply

      1. Hi Stefan,
        thanks a lot. I found the relevant information in the eventviewer. The SQL Databases were not reachable. The Service of the SQL Instance stopped. After a reboot of all servers everything worked fine again.

        Best regards
        Stefan

        Reply

  6. Hi there, when I click the link above for the download for the October CU it takes me to a security update dated from September, which there are apparently problems with.

    Reply

    1. Hi,
      the download link goes to the security updates uploaded on September 23st, 2025.
      These are the October updates – not the September Updates. Please check the KB article numbers listed on the download page and you will see that they are KB5002788 and KB5002787 which are the October CU KBs.
      Cheers,
      Stefan

      Reply

      1. Okay thank you for the clarification!

        Reply

  7. I removed the NT Authority\System account and started the install. Both were successful. When I ran the configuration wizard it errors out on step 10 – Error: CopySidebySide file for inplace Upgrade failed. I ran the PSConfig.exe command from Shell and it was successful, however, it didnt actually apply the patch to the server farm. Still showing on version 16.0.5517. Also notice the NT Authority Account is still present in WSS_WPG. Should I remove that account again and run the wizard?

    Reply

    1. Hi Lance,
      please check in control panel if the fixes were installed in the “view installed updates” section.
      The build number does not always change.
      As October CU reverts the permission change I would recommend to check on 14\template\layouts and 16\template\layouts if the deny permission for WSS_WPG and IIS_IUSRS are still there.
      If yes, remove the deny Access Control Entry ACE (do not change any other ACE)
      If the fixes are not listed as installed in central admin install them again after this change.
      And run the config wizard again.
      Cheers,
      Stefan

      Reply

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.