Description of the security update for SharePoint Server Subscription Edition: November 10, 2026 (KB5002945)

Summary

       $farm = Get-SPFarm
       $farm.ServerDebugFlags.Add(53601)
       $farm.update()
       iisreset

This security update resolves a Microsoft SharePoint Server information disclosure, Microsoft SharePoint Server remote code execution vulnerability, Microsoft SharePoint Server spoofing vulnerability, Microsoft Word remote code execution vulnerability, Microsoft SharePoint Server security feature bypass vulnerability, and Microsoft SharePoint elevation of privilege vulnerability. To learn more about the vulnerabilities, see the following security advisories:

• Microsoft Common Vulnerabilities and Exposures CVE-2026-80095
• Microsoft Common Vulnerabilities and Exposures CVE-2026-120002
• Microsoft Common Vulnerabilities and Exposures CVE-2026-120000
• Microsoft Common Vulnerabilities and Exposures CVE-2026-112736
• Microsoft Common Vulnerabilities and Exposures CVE-2026-111303
• Microsoft Common Vulnerabilities and Exposures CVE-2026-111300
• Microsoft Common Vulnerabilities and Exposures CVE-2026-111297
• Microsoft Common Vulnerabilities and Exposures CVE-2026-111296
• Microsoft Common Vulnerabilities and Exposures CVE-2026-110065
• Microsoft Common Vulnerabilities and Exposures CVE-2026-110057
• Microsoft Common Vulnerabilities and Exposures CVE-2026-110045
• Microsoft Common Vulnerabilities and Exposures CVE-2026-88176

Improvements and fixes

This security update contains improvements and fixes for the following nonsecurity issues in SharePoint Server Subscription Edition:

• Fixes an issue in SharePoint Server Subscription Edition in which the SharePoint Search Host Controller service might stop unexpectedly after you manually stop and restart it.

• Adds support for the permanent time zones in Alberta (UTC-6) and British Columbia (UTC-7), and keeps the historical daylight saving time transitions for both provinces through March 2026.

• SharePoint Server will start blocking remote event receivers that are registered without an application identity in the March 2027 Public Update, not the November 2026 Public Update as previously announced. To find affected receivers that are registered at the list level, use the Get-SPOrphanedRemoteEventReceiver cmdlet.

• Notifies that the InfoPath Forms Services feature will be disabled starting with the September 2026 Cumulative Update. To enable the feature, add the DisableInfoPathRetirement debug flag (5023) to the SharePoint farm, enable browser form rendering, and enable browser form activation. To perform these actions, run the following script in the SharePoint Management Shell as an administrator:

$ErrorActionPreference = 'Stop'
$sharePointLoaded = Get-Command -ListImported -CommandType Cmdlet |
    Where-Object { $_.Name -eq 'Get-SPFarm' }
if (-not $sharePointLoaded) {
    Add-PSSnapin -Name 'Microsoft.SharePoint.PowerShell' -ErrorAction Stop
}
Get-Command Get-SPFarm -ErrorAction Stop | Out-Null
$assembly = [System.Reflection.Assembly]::LoadWithPartialName(
    'Microsoft.Office.InfoPath.Server'
)
if ($null -eq $assembly) {
    throw 'Could not load Microsoft.Office.InfoPath.Server.'
}
$farm = Get-SPFarm
$formService = $farm.Services |
    Where-Object {
        $_ -is [Microsoft.Office.InfoPath.Server.Administration.FormsService]
    } |
    Select-Object -First 1
if ($null -eq $formService) {
    throw 'Forms Service not found.'
}
# Set the retirement override before enabling browser support.
if (-not $farm.ServerDebugFlags.Contains(5023)) {
    [void]$farm.ServerDebugFlags.Add(5023)
    $farm.Update()
}
$farm = Get-SPFarm
if (-not $farm.ServerDebugFlags.Contains(5023)) {
    throw 'Debug flag 5023 was not persisted.'
}
$formService = $farm.Services |
    Where-Object {
        $_ -is [Microsoft.Office.InfoPath.Server.Administration.FormsService]
    } |
    Select-Object -First 1
if ($null -eq $formService) {
    throw 'Forms Service not found after updating the farm.'
}
$formService.AllowUserFormBrowserRendering = $true
$formService.AllowUserFormBrowserEnabling = $true
$formService.Update()
# Re-read and verify the configuration.
$farm = Get-SPFarm
$formService = $farm.Services |
    Where-Object {
        $_ -is [Microsoft.Office.InfoPath.Server.Administration.FormsService]
    } |
    Select-Object -First 1
if ($null -eq $formService) {
    throw 'Forms Service not found during verification.'
}
if (-not $farm.ServerDebugFlags.Contains(5023)) {
    throw 'Debug flag 5023 is missing during verification.'
}
if (-not $formService.AllowUserFormBrowserRendering -or
    -not $formService.AllowUserFormBrowserEnabling) {
    throw 'Forms Service browser settings were not enabled.'
}
Write-Host 'Retirement override set:' $farm.ServerDebugFlags.Contains(5023)
Write-Host 'Rendering enabled:' $formService.AllowUserFormBrowserRendering
Write-Host 'Browser enabling enabled:' $formService.AllowUserFormBrowserEnabling

To disable the feature, disable browser form rendering and activation, and remove debug flag 5023 from the farm. To perform these actions, run the following script in the SharePoint Management Shell as an administrator:

$ErrorActionPreference = 'Stop'
# Load the SharePoint snap-in only if its cmdlet is not already loaded.
$sharePointLoaded = Get-Command -ListImported -CommandType Cmdlet |
    Where-Object { $_.Name -eq 'Get-SPFarm' }
if (-not $sharePointLoaded) {
    Add-PSSnapin -Name 'Microsoft.SharePoint.PowerShell' -ErrorAction Stop
}
Get-Command Get-SPFarm -ErrorAction Stop | Out-Null
$assembly = [System.Reflection.Assembly]::LoadWithPartialName(
    'Microsoft.Office.InfoPath.Server'
)
if ($null -eq $assembly) {
    throw 'Could not load Microsoft.Office.InfoPath.Server.'
}
$farm = Get-SPFarm
$formService = $farm.Services |
    Where-Object {
        $_ -is [Microsoft.Office.InfoPath.Server.Administration.FormsService]
    } |
    Select-Object -First 1
if ($null -eq $formService) {
    throw 'Forms Service not found.'
}
# Disable browser support before restoring retirement.
$formService.AllowUserFormBrowserRendering = $false
$formService.AllowUserFormBrowserEnabling = $false
$formService.Update()
if ($farm.ServerDebugFlags.Contains(5023)) {
    [void]$farm.ServerDebugFlags.Remove(5023)
    $farm.Update()
}
# Re-read and verify the configuration.
$farm = Get-SPFarm
$formService = $farm.Services |
    Where-Object {
        $_ -is [Microsoft.Office.InfoPath.Server.Administration.FormsService]
    } |
    Select-Object -First 1
if ($null -eq $formService) {
    throw 'Forms Service not found during verification.'
}
if ($farm.ServerDebugFlags.Contains(5023)) {
    throw 'Debug flag 5023 was not removed.'
}
if ($formService.AllowUserFormBrowserRendering -or
    $formService.AllowUserFormBrowserEnabling) {
    throw 'Forms Service browser settings were not disabled.'
}
Write-Host 'Retirement override set:' $farm.ServerDebugFlags.Contains(5023)
Write-Host 'Rendering enabled:' $formService.AllowUserFormBrowserRendering
Write-Host 'Browser enabling enabled:' $formService.AllowUserFormBrowserEnabling

If the DisableInfoPathRetirement debug flag (5023) was never added, and if InfoPath Forms Services is already disabled, no additional action is required.

How to get and install the update

Method 1: Microsoft Update

This update is available from Microsoft Update. When you turn on automatic updating, this update will be downloaded and installed automatically. For more information about how to get security updates automatically, see Windows Update: FAQ.

Method 2: Microsoft Update Catalog

To get the standalone package for this update, go to the Microsoft Update Catalog website.

Method 3: Microsoft Download Center

You can get the standalone update package through the Microsoft Download Center. Follow the installation instructions on the download page to install the update.

• Download the security update for Microsoft SharePoint Server Subscription Edition (KB5002945)

More information

Security update deployment information

For deployment information about this update, see Deployments - Security Update Guide.

Security update replacement information

This security update replaces previously released security update 5002927.

File hash information

File information

Download the list of files that are included in Security Update 5002945.

Information about protection and security

Protect yourself online: Windows Security support.

Learn how we guard against cyber threats: Microsoft Security