SharePoint security fixes released with June 2026 PU and offered through Microsoft Update

Important: If your current farm patch level is September 2025 CU, execute the following PowerShell script to correct the folder permissions on the relevant folders otherwise installing the SharePoint fixes will fail:
Fix-SeptemberCU-Permission-Problem.ps1

Alternatively you can also remove the NT Authority\system account from WSS_WPG and IIS_IUSRS local security groups of the SharePoint machines.

For more details check this article: Trending Issue: SharePoint fixes fail to install after installation of September 2025 CU

Below are the security fixes for the SharePoint OnPrem versions released this month.

SharePoint Server 2016:

  • KB 5002880 – SharePoint Server 2016 (language independent)
  • KB 5002881 – SharePoint Server 2016 (language dependent)

Microsoft Support recommends to install the complete June 2026 CU for SharePoint 2016 rather than individual security fixes.

SharePoint Server 2019:

  • KB 5002874 – SharePoint Server 2019 (language independent)
  • KB 5002876 – SharePoint Server 2019 (language dependent)

Microsoft Support recommends to install the complete June 2026 CU for SharePoint 2019 rather than individual security fixes.

SharePoint Server Subscription Edition:

  • KB 5002873 – SharePoint Server Subscription Edition

This security fix is identical with June 2026 CU for SharePoint Server Subscription Edition.

Office Online Server:

  • KB 5002875 – Office Online Server
Please ensure to have a look at the SharePoint Patching Best Practices before applying new fixes.

 


Security Vulnerabilities fixed in this PU

Vulnerability SP 2016 SP 2019 SP SE OOS Impact Max Severity
CVE-2026-33113 x x x Spoofing Important
CVE-2026-35439 x x x Remote Code Execution Important
CVE-2026-44817 x Remote Code Execution Important
CVE-2026-44818 x Remote Code Execution Important
CVE-2026-44819 x x x Remote Code Execution Important
CVE-2026-44820 x Remote Code Execution Important
CVE-2026-44821 x x x Information Disclosure Important
CVE-2026-44822 x Information Disclosure Important
CVE-2026-44823 x Remote Code Execution Important
CVE-2026-44824 x x x Remote Code Execution Important
CVE-2026-45453 x x x Spoofing Important
CVE-2026-45454 x x x Remote Code Execution Important
CVE-2026-45455 x Information Disclosure Important
CVE-2026-45456 x x x Remote Code Execution Critical
CVE-2026-45458 x x x Remote Code Execution Critical
CVE-2026-45462 x x x Spoofing Important
CVE-2026-45464 x x x Spoofing Important
CVE-2026-45465 x x x Spoofing Important
CVE-2026-45467 x x x Spoofing Important
CVE-2026-45468 x x x Spoofing Important
CVE-2026-45469 x Remote Code Execution Important
CVE-2026-45471 x x x Remote Code Execution Important
CVE-2026-45475 x x x Remote Code Execution Important
CVE-2026-45479 x x x Spoofing Important
CVE-2026-45481 x x x Spoofing Important
CVE-2026-45483 x x x Spoofing Important
CVE-2026-45484 x x x Elevation of Privilege Important
CVE-2026-45485 x x x Information Disclosure Important
CVE-2026-47298 x x x Remote Code Execution Important
CVE-2026-47634 x x Spoofing Important
CVE-2026-47636 x x x Spoofing Important
CVE-2026-47637 x x x Spoofing Important
CVE-2026-47638 x x x Spoofing Important
CVE-2026-47639 x x x Spoofing Important
CVE-2026-47640 x x x Spoofing Important
CVE-2026-47641 x x x Spoofing Important
CVE-2026-48560 x x x Spoofing Important
CVE-2026-48562 x x x Spoofing Important

See the Security Update Guide below for more details about the relevant fixes:

5 Comments


  1. Web page “New and improved features in SharePoint Server Subscription Edition 26H1 release” is missing. It does not exist.

    Reply

  2. On webpage “https://learn.microsoft.com/en-us/officeupdates/sharepoint-updates” June patch is not published under any SharePoint version.

    Reply

  3. hi Stefan
    Will there be a KB release on 14th July for SharePoint 2016 which is end of support date, or is June 2016 is the last one?
    THanks

    Reply

    1. Hi Ramen,
      there will most likely be one final CU on July 14th.
      Cheers,
      Stefan

      Reply

  4. I installed the June 2026 CU on 14 SharePoint farms. I have experienced the same two issues as last month. Sometimes the issues appeared a few days later, after Windows Updates were installed. Windows Servers was restarted after each update.

    1️⃣ So far 9 farms had Search Service Application either in error state or remained in “Paused for:External request”.
    ➡️After restarting the “SharePoint Search Host Controller” and waiting about a minute, Search worked again. On two farms I had to do this twice.

    2️⃣ On 1 farm the SharePoint Website response time changed from 0.3 seconds to exactly 80 seconds (which resulted in some timeouts). The issue occurred after latest Windows Updates were installed.
    ➡️ After running PSConfig again, the issue was resolved. PSConfig already ran successfully a few days ago.

    Hope this helps someone else.

    Cheers from 🇨🇭,
    Benjamin

    Reply

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.