KB5002861 — Security Update for SharePoint Server 2016

Overview

KB5002861 is a critical security update released on April 14, 2026, for SharePoint Server 2016. This update addresses multiple security vulnerabilities including remote code execution and elevation of privilege issues that could allow attackers to compromise SharePoint environments. The update applies to both SharePoint Server 2016 Enterprise and Standard editions running on supported Windows Server platforms.

Security Vulnerabilities Addressed

This security update resolves several critical vulnerabilities in SharePoint Server 2016 that could be exploited by attackers to:

• Execute arbitrary code remotely on affected SharePoint servers through malicious file uploads and web part exploitation
• Elevate privileges within the SharePoint environment to gain administrative access
• Bypass authentication mechanisms in SharePoint Central Administration and service applications
• Access sensitive information through improper input validation in lists and libraries
• Perform cross-site scripting attacks against SharePoint users through malicious content injection

These vulnerabilities affect SharePoint Server 2016 installations running on Windows Server 2012 R2, Windows Server 2016, Windows Server 2019, and Windows Server 2022. The issues primarily impact SharePoint web applications, Central Administration, and core SharePoint services including the User Profile Service and Search Service Application.

Root Cause Analysis

The vulnerabilities stem from several security weaknesses in SharePoint Server 2016 components:

• Improper Input Validation: Insufficient validation of user-supplied data in web parts and custom solutions
• Access Control Issues: Inadequate permission checks in SharePoint Central Administration and service applications
• Authentication Bypass: Weak token validation in SharePoint Security Token Service (STS)
• Output Encoding Flaws: Improper sanitization of content in SharePoint lists and document libraries

Affected Systems

KB5002861 applies to the following SharePoint Server 2016 configurations:

Security Fixes Included

Remote Code Execution Vulnerability Fix

This update patches a critical remote code execution vulnerability in SharePoint Server 2016 web applications. The fix improves input validation for user-supplied data and strengthens security boundaries between SharePoint components. This prevents attackers from executing arbitrary code by uploading malicious files or exploiting web part vulnerabilities.

Components updated:

• SharePoint Foundation 2016 core libraries
• SharePoint Server 2016 web application framework
• SharePoint web parts processing engine
• File upload and validation mechanisms

Elevation of Privilege Protection

Addresses an elevation of privilege vulnerability that could allow authenticated users to gain administrative access to SharePoint Central Administration. The update implements proper access control validation and strengthens permission checks for administrative operations.

Security improvements:

• Enhanced permission validation for Central Administration access
• Improved authentication checks for administrative functions
• Strengthened role-based access control mechanisms
• Updated service application security boundaries

Cross-Site Scripting (XSS) Protection

Fixes multiple cross-site scripting vulnerabilities in SharePoint lists, document libraries, and custom web parts. The update improves input sanitization and output encoding to prevent malicious script injection attacks.

Areas protected:

• SharePoint list views and forms
• Document library metadata handling
• Custom web part content rendering
• Search result display components
• User profile information display

Authentication Bypass Prevention

Resolves authentication bypass vulnerabilities in SharePoint Server 2016 services that could allow unauthorized access to protected resources. The update enhances token validation and session management mechanisms.

Services updated:

• SharePoint Security Token Service (STS)
• Claims-based authentication components
• SharePoint service application framework
• User Profile Service authentication
• Search Service Application security

Installation and Deployment

KB5002861 is available through multiple deployment channels for SharePoint Server 2016 environments. Organizations should plan for a maintenance window as the update requires SharePoint services to restart during installation.

Microsoft Update Catalog

Download the update package directly from Microsoft Update Catalog for manual installation. The update file size is approximately 485 MB and requires local administrator privileges for installation. This method is suitable for single-server farms or environments where automated deployment is not available.

Enterprise Deployment Options

Windows Server Update Services (WSUS): Enterprise environments can deploy KB5002861 through WSUS by approving the update for SharePoint Server 2016 computer groups. The update will appear in the Microsoft SharePoint classification and can be scheduled for deployment during maintenance windows.

System Center Configuration Manager (SCCM): Deploy the update through SCCM software update management by synchronizing the Microsoft SharePoint updates catalog and creating deployment packages for affected SharePoint servers. This provides the most control over deployment timing and rollback capabilities.

Prerequisites and Requirements

Before installing KB5002861, ensure the following prerequisites are met:

• SharePoint Server 2016 with Service Pack 1 or later installed
• Windows Server 2012 R2 or later operating system
• Minimum 2 GB free disk space on system drive
• All SharePoint services must be running during installation
• SharePoint Configuration Wizard must be accessible
• SQL Server connectivity for SharePoint databases

Installation Requirements:

• Restart Required: Yes, SharePoint services restart required
• Installation Time: 15-30 minutes depending on farm size and server specifications
• Downtime: Minimal service interruption during installation and service restart
• Rollback: Supported through Windows Update uninstall process

Post-Installation Considerations

After installing KB5002861, administrators should verify that all SharePoint services are functioning correctly and monitor for any compatibility issues with custom solutions or third-party components. The update includes changes to SharePoint's security model that may affect custom web parts or applications that rely on deprecated APIs.