Description of the security update for SharePoint Server Subscription Edition: January 13, 2026 (KB5002822)

Summary

Important:

If you're currently running SharePoint Workflow Manager, you must install SharePoint Workflow Manager (KB5002799) to your farm before you install this cumulative update.
If you're currently running the Classic version of Workflow Manager, you have to enable the debug flag in order to continue using it:$farm = Get-SPFarm

$farm.ServerDebugFlags.Add(53601)

$farm.update()

iisreset

This security update resolves a Microsoft Office Click-To-Run Elevation of Privilege vulnerability, Microsoft Word Remote Code Execution, Microsoft SharePoint Remote Code Execution vulnerability, Microsoft SharePoint Information Disclosure vulnerability, Microsoft SharePoint Server Remote Code Execution vulnerability and Microsoft SharePoint Server Spoofing vulnerability. To learn more about the vulnerabilities, see the following security advisories:

Notes:

This is build 16.0.19127.20442 of the security update package.
To apply this security update, you must have the release version of Microsoft SharePoint Server Subscription Edition installed on the computer.

Improvements and fixes

This security update introduces the SharePoint Server Subscription Edition Version 25H2 feature update. This feature update will be included in all SharePoint Server Subscription Edition public updates going forward. For more information about this feature update, see New and improved features in SharePoint Server Subscription Edition Version 25H2.

This security update contains improvements and fixes for the following nonsecurity issues in SharePoint Server Subscription Edition:

This update integrates SharePoint Server with the ECS .NET Client library to enable URL blocking.
This update fixes the GB18030-2022 certification issue.
This update fixes an issue in which the UPA‑backed claims provider doesn't resolve groups in the People Picker if a group name contains special characters.
This update fixes an issue that causes the DateOnly column to also display the time in the modern information panel.
This update fixes an issue in which some links lack discernible text or contain only images or icons without accessible alternative text.
This update adjusts the brightness of the star icon in the Favorites panel for better visibility.
This update fixes an issue in which the Drop an image section option doesn't appear focused when you navigate by using the keyboard and doesn't display any hover-triggered popup window.
This update fixes an issue in which the focus leaves the Image gallery layout property pane when you navigate by using the Tab key.
This update fixes an issue in which the focus leaves the Font color popup window in the Text and tableformatting pane when you navigate by using the Tab key.
This update fixes an accessibility issue in the Permissions dialog box.
This update fixes an accessibility issue by making the info icon accessible when you navigate by using the keyboard.
This update fixes the data duplication issue that occurs during the Remote Blob Storage (RBS) migration.

How to get and install the update

Method 1: Microsoft Update

This update is available from Microsoft Update. When you turn on automatic updating, this update will be downloaded and installed automatically. For more information about how to get security updates automatically, see Windows Update: FAQ.

Method 2: Microsoft Update Catalog

To get the standalone package for this update, go to the Microsoft Update Catalog website.

Method 3: Microsoft Download Center

You can get the standalone update package through the Microsoft Download Center. Follow the installation instructions on the download page to install the update.

Download security update for Microsoft SharePoint Server Subscription Edition (KB5002822).

More information

Security update deployment information

For deployment information about this update, see Deployments - Security Update Guide.

Security update replacement information

This security update replaces previously released security update 5002815.

File hash information

File name	SHA256 hash
uber-subscription-kb5002822-fullfile-x64-glb.exe	02DBE2F252FE8E3037B76A5735F7B8525E95634998EA45EA1D51136B806041FB

File information

Download the list of files that are included in Security Update 5002822.

Information about protection and security

Protect yourself online: Windows Security support

Learn how we guard against cyber threats: Microsoft Security