For more details check this article: Trending Issue: SharePoint fixes fail to install after installation of September 2025 CU
The product group released the October 2025 Cumulative Update for SharePoint Server 2016 product family.
This CU also includes Feature Pack 1 which was released with December 2016 CU and Feature Pack 2 which was released with September 2017 CU.
The KB articles for October 2025 CU should be available at the following locations in a couple of hours:
- KB 5002788 – October 2025 Update for SharePoint Server 2016 (language independent)
This is also a security update! - KB 5002787 – October 2025 Update for SharePoint Server 2016 (language dependent)
This is also a security update!
The downloads for October 2025 CU are available through the following links:
- Download October 2025 Update for SharePoint Server 2016 (language independent)
This is also a security update! - Download October 2025 Update for SharePoint Server 2016 (language dependent)
This is also a security update!
Important: It is required to install both fixes (language dependent and independent) to fully patch a SharePoint server. This applies also to servers which do not have language packs installed. The reason is that each SharePoint installation includes a language dependent component together with a language independent component. If additional language packs are added later (only) the language dependent fix has to be applied again.
It is irrelevant which language you pick on the drop down in download center. Even the language dependent fixes are all in the same package for all languages.
After installing the fixes you need to run the SharePoint 2016 Products Configuration Wizard on each machine in the farm. If you prefer to run the command line version psconfig.exe ensure to have a look here for the correct options.
SharePoint 2016 October 2025 CU Build Numbers:
Language independent fix: 16.0.5522.1000
Language dependent fix: 16.0.5522.1000
To understand the different version numbers please have a look at my article which explains the different SharePoint build numbers.
Please ensure to have a look at the SharePoint Patching Best Practices before applying new fixes.
Related Links:
- Technet: Updated Product Servicing Policy for SharePoint Server 2016
- Blog: SharePoint Patching Best Practices
- Blog: Common Question: What is the difference between a PU, a CU and a COD?
- Blog: SharePoint Patching demystified
- Blog: Why I prefer PSCONFIGUI.EXE over PSCONFIG.EXE
- Technet: Update Center for Microsoft Office, Office Servers, and Related Products
- Blog: SharePoint Server 2016 Patch Build Numbers Powershell Module
- Blog: SharePoint Server 2016 Zero-Downtime Patching Demystified
- Blog: SharePoint does not have a build version. Full Stop.

Permalink
Hello
We installed July Kbs in our 2016 farm.
Now we are planning to install October patch.
Step1: -As per MS …If you’re running 2013-type workflows, you must install the August 2025 update for SharePoint Workflow Manager to your farm before you install this cumulative update.
Step2: -If you’re currently running the Classic version of Workflow Manager, you must enable the debug flag to continue using it:
$farm = Get-SPFarm
$farm.ServerDebugFlags.Add(53601)
$farm.update()
iisreset
My question is how we Know which workflow running in farm.
Permalink
Hi Ram,
please check which software is installed on your WFM server.
It is either Microsoft Workflow Manager (the classic one) or SharePoint Workflow Manager.
Cheers,
Stefan
Permalink
In October 2025, CU is also getting same workflow message
Permalink
Which message?
Permalink
Hi Stefan
First of all, thanks for your amazing work on this blog and in regards to Sharepoint as a whole.
I have a question I hope you can find the time to answer.
Our environment is a 2016 on-prem, most recent CU is the July one. I was very hesitant to update to the September CU because of the issues introduced, and ended up waiting for the October CU which seems to have fixed most of the issues.
Leading to my question:
I remember you had all the issues listed in the same post – I can’t seem to find that post now, but are all of the issues that were introduced with the September CU fixed in the October CU?
Specifically: Can I go from July to October CU without needing to do anything out of the ordinary?
Best regards,
Andy
Permalink
Hi Andy,
I assume this is the post you are referring to:
https://blog.stefan-gossner.com/2025/09/25/summary-and-status-of-issues-identified-with-september-2025-cu-for-sharepoint/
Yes you can go directly from July CU to October CU.
No special precautions except that SharePoint Workflow Manager has to be on August CU or October CU as well if it is integrated with your SharePoint farm.
Cheers,
Stefan
Permalink
Thanks for the very quick response – that sounds great!
That is indeed the post I was referring to, and thanks for providing me with the link.
Best regards,
Andy
Permalink
Just to clarify,
I dont need to pay attention to which users are in the wss_wpg and iis_iusrs when going from July CU to October CU?
Best regards,
Andy
Permalink
Yes, this is correct.
Permalink
Hi Stefan. After install the SharePoint CU today, all of the Central Admin errors cleared except for 4. For some reason, when I installed September and removed the local accounts, there were initially 4 individual servers with the error message and another error for 4 more servers. The next day (maybe after I re-removed the local accounts), 2 of the individual servers were added to the group + another new server (making 7 in the group). The 3rd day, another one joined the group (making 8). The 4th day, another joined the group (making 9). So, before the patch, I had 1 error message with 9 servers (2 APPs, 3 of 4 WFEs, 4 of 4 SRCH) and 4 individual error messages for 4 servers). After today’s patch, the 4 original errors still remain “Verify various user groups don’t have elevated permissions” (It’s for 2 APP servers, 1 of 4 WFEs, and 1 of 4 SRCH servers). The group of 9 servers cleared.
Any thoughts? Maybe it will take them 4 days to totally clear. LOL
Permalink
Hi Marlene,
these health rule messages are a known issue in September and October CU.
The root cause is known and our product group is currently working on a fix.
Cheers,
Stefan
Permalink
Hi Stefan,
I have a SP2016 Farm with two servers. Last Month September CU was installed, everything works fine. Now I wanted to install the October CU. I removed the System Account from the WSS_WPG Group, in the IIS_IUSRS Group the User was not present. Afterwords I tried to install the CU file, but the installation stuck on the installation without any progress.
For me it is not possible to start any of these:
– Central Administration
– Product and Configuration Wizard
– Any Web Application
– Sharepoint Management Shell
What could be the problem for this?
Best regards
Stefan
Permalink
Hi Stefan,
if the installer got stuck, the most likely a mix of file versions exists on the server.
Please try to run the installation again. If it fails again it might require to rebuild the server.
After all the installation file of SharePoint need to be consistent and all belong to the same patch level.
Cheers,
Stefan
Permalink
Hi Stefan,
thanks a lot. I found the relevant information in the eventviewer. The SQL Databases were not reachable. The Service of the SQL Instance stopped. After a reboot of all servers everything worked fine again.
Best regards
Stefan
Permalink
Hi there, when I click the link above for the download for the October CU it takes me to a security update dated from September, which there are apparently problems with.
Permalink
Hi,
the download link goes to the security updates uploaded on September 23st, 2025.
These are the October updates – not the September Updates. Please check the KB article numbers listed on the download page and you will see that they are KB5002788 and KB5002787 which are the October CU KBs.
Cheers,
Stefan
Permalink
Okay thank you for the clarification!
Permalink
I removed the NT Authority\System account and started the install. Both were successful. When I ran the configuration wizard it errors out on step 10 – Error: CopySidebySide file for inplace Upgrade failed. I ran the PSConfig.exe command from Shell and it was successful, however, it didnt actually apply the patch to the server farm. Still showing on version 16.0.5517. Also notice the NT Authority Account is still present in WSS_WPG. Should I remove that account again and run the wizard?
Permalink
Hi Lance,
please check in control panel if the fixes were installed in the “view installed updates” section.
The build number does not always change.
As October CU reverts the permission change I would recommend to check on 14\template\layouts and 16\template\layouts if the deny permission for WSS_WPG and IIS_IUSRS are still there.
If yes, remove the deny Access Control Entry ACE (do not change any other ACE)
If the fixes are not listed as installed in central admin install them again after this change.
And run the config wizard again.
Cheers,
Stefan