SharePoint security fixes released with September 2026 PU and offered through Microsoft Update

12 Comments

1. 

   Paul
   On 9. September 2026 Permalink

   Hello Stefan,
   You listed 16 vulnerabilities for SPSE, but in the “Description of the security update for SharePoint Server Subscription Edition: September 08, 2026” article there are 17 listed.

   The one that is missing here is CVE-2026-65665 with Max Severity: Critical

   Reply
   1. 

      Mary
      On 9. September 2026 Permalink

      CVE-2026-65665 is on list for September but was released with August CU.

      Reply
2. 

   Sven
   On 9. September 2026 Permalink

   Hello Paul,
   CVE-2026-65665 was already listed as fixed in the KB article for August CU.

   Reply
3. 

   Jacob
   On 9. September 2026 Permalink

   The fix is targeted for the October PU release.

   Reply
4. 

   Donna
   On 22. September 2026 Permalink

   Hi. I noticed in this page referenced above (KB 5127194 – September 2026 updates for Microsoft Office) that it lists a September update for SharePoint Workflow Manager, but you do not have your usual article when there is an update for SharePoint Workflow Manager (https://support.microsoft.com/en-us/servicing/office/hotfix/sharepoint/5002925). Is there anything we need to know about this update other than what’s already been discussed about 2010 Workflows? Thank you.

   Reply
   1. 

      Stefan Goßner
      On 23. September 2026 Permalink

      Hi Donna,
      the reason is, that this fix was NOT released on September 8th – even that the KB article states so.
      If you look carefully at the fix you will notice that it was released 3 days later on September 11th:
      https://www.microsoft.com/en-us/download/details.aspx?id=108826
      The link to this SPWFM fix was added later to KB 5127194 in a later update as well.
      From what I heard the initial plan was to release the fix on September 8th with the other updates but a problem caused a delay and the fix was now pushed out of band outside the regular schedule.
      Cheers,
      Stefan

      Reply
5. 

   William Chung
   On 30. September 2026 Permalink

   SharePoint Classic Tool Panes were also disabled by default following the SEP 2026 SP SE CU. If you are still using classic web parts, you’ll need to re-enable the Tool Panes to enable editing classic web parts.

   https://blog.dafran.ca/post/2026/09/20/ToolPane-Disabled-in-SharePoint

   To re-enable:

   Get-SPSite -Limit All | ForEach-Object {
   Write-Host “Enabling ToolPane: $($.Url)” -ForegroundColor Cyan
   Enable-SPToolPane -Identity $.Url
   }

   Reply
   1. 

      Stefan Goßner
      On 30. September 2026 Permalink

      This is correct – and was also mentioned in the KB article for September CU including the PowerShell command to reenable them.

      Reply
   2. 

      Sven
      On 5. October 2026 Permalink

      Thank you for that – my customer was really unhappy about that change 🙂

      Reply
6. 

   Oliver Soberic
   On 6. October 2026 Permalink

   Hi all,
   have recent SharePoint 2019 updates somehow blocked loading JS files from script editor web part (Web parts are working properly) ?
   All javascript we have used from SPutility.js and jquery has stopped working. JS files are stored on the same site, in assets folder. Thanks.

   Reply
   1. 

      Stefan Goßner
      On 6. October 2026 Permalink

      Hi Oliver,
      I’m not aware of such a change but haven’t tried myself.
      Which exact CU has been installed on your machines?
      Cheers,
      Stefan

      Reply
      1. 

         Oliver
         On 6. October 2026 Permalink

         Hi Stefan,
         security update for SharePoint Server 2019: August 11, 2026 (KB5002894) is installed.
         security update for SharePoint Server 2019 Language Pack: August 11, 2026 (KB5002896)
         Configuration database version: 16.0.10417.20198

         Thank you

         Reply