Description of the security update for SharePoint Server Subscription Edition: April 14, 2026 (KB5002853)

Summary

Important:

If you're currently running SharePoint Workflow Manager, you must install SharePoint Workflow Manager (KB5002799) to your farm before you install this cumulative update.
If you're currently running the Classic version of Workflow Manager, you have to enable the debug flag in order to continue using it:$farm = Get-SPFarm

$farm.ServerDebugFlags.Add(53601)

$farm.update()

iisreset

This security update resolves Microsoft SharePoint Server spoofing vulnerability. To learn more about the vulnerability, see the following security advisories:

Notes:

This is build 16.0.19725.20210 of the security update package.
To apply this security update, you must have the release version of Microsoft SharePoint Server Subscription Edition installed on the computer.

Improvements and fixes

This security update contains improvements and fixes for the following nonsecurity issues in SharePoint Server Subscription Edition:

This update fixes the GB18030-2022 certification issue.
This update improves ingestion throughput by increasing the hit rate of the cache that's used during the ingestion process.
This update fixes an issue in SharePoint Server Subscription Edition (On‑Premises) in which appending the query parameter p to publishing page URLs causes unexpected UI behavior. If p=2, the page renders a File Picker–style interface instead of the expected publishing page. This behavior occurs because client‑side routing logic interprets "p=2" as a page type for File Picker.
This update fixes an issue in which the SPOONSOnboard-CloudHybridSearch-SPOONS.ps1 script fails on new tenants by updating validation to use the Azure Active Directory (Azure AD) App ID instead of the app name.
This update fixes a rich text editor issue that prevents you from creating a line return by using the Enter key after you insert hyperlinks.
This update fixes an issue in which the default Office options don't appear after you enable the custom document content types in a document library.

How to get and install the update

Method 1: Microsoft Update

This update is available from Microsoft Update. When you turn on automatic updating, this update will be downloaded and installed automatically. For more information about how to get security updates automatically, see Windows Update: FAQ.

Method 2: Microsoft Update Catalog

To get the standalone package for this update, go to the Microsoft Update Catalog website.

Method 3: Microsoft Download Center

You can get the standalone update package through the Microsoft Download Center. Follow the installation instructions on the download page to install the update.

Download security update for Microsoft SharePoint Server Subscription Edition (KB5002853).

More information

Security update deployment information

For deployment information about this update, see Deployments - Security Update Guide.

Security update replacement information

This security update replaces previously released security update 5002843.

File hash information

File name	SHA256 hash
uber-subscription-kb5002853-fullfile-x64-glb.exe	3E365B7334AE47ED20A82A1F32D68A7CD4B1C9860CF364BDA4780A122EE43097

File information

Download the list of files that are included in Security Update 5002853.

Information about protection and security

Protect yourself online: Windows Security support

Learn how we guard against cyber threats: Microsoft Security