KB5002833 — Security Update for SharePoint Server Subscription Edition

Overview

KB5002833 is a critical security update released on February 10, 2026, for SharePoint Server Subscription Edition. This update addresses multiple high-severity vulnerabilities that could allow attackers to execute arbitrary code, escalate privileges, or access sensitive information within SharePoint environments.

Security Vulnerabilities Addressed

This security update resolves four critical vulnerabilities in SharePoint Server Subscription Edition:

CVE-2026-0847: Remote Code Execution Vulnerability

A critical vulnerability in SharePoint web parts processing allows remote attackers to execute arbitrary code on the SharePoint server. This vulnerability occurs due to insufficient input validation when processing web part parameters, enabling attackers to inject malicious code through specially crafted requests.

CVE-2026-0848: Elevation of Privilege Vulnerability

An elevation of privilege vulnerability allows authenticated users to gain unauthorized administrative access to SharePoint sites and content. The vulnerability stems from improper privilege validation in SharePoint's authentication mechanisms.

CVE-2026-0849: Cross-Site Scripting Vulnerability

A cross-site scripting vulnerability enables attackers to inject malicious scripts into SharePoint pages, potentially compromising user sessions and stealing sensitive information. This occurs due to inadequate output encoding in SharePoint page rendering.

CVE-2026-0850: Information Disclosure Vulnerability

An information disclosure vulnerability could expose sensitive SharePoint configuration data to unauthorized users through improper access controls on administrative endpoints.

Affected Systems

This security update applies to:

Technical Details

The security fixes in KB5002833 modify several core SharePoint components:

Updated Components

• Microsoft.SharePoint.WebPartPages.dll - Version 16.0.15601.20148
• Microsoft.SharePoint.ApplicationPages.dll - Version 16.0.15601.20148
• Microsoft.SharePoint.Security.dll - Version 16.0.15601.20148
• Microsoft.SharePoint.WebControls.dll - Version 16.0.15601.20148
• Microsoft.SharePoint.Administration.dll - Version 16.0.15601.20148

Security Enhancements

The update implements several security improvements:

• Enhanced Input Validation: Stricter validation of user input across all SharePoint components
• Improved Output Encoding: Comprehensive HTML encoding to prevent XSS attacks
• Strengthened Authentication: Enhanced privilege checking and token validation
• Access Control Improvements: Restricted access to sensitive configuration endpoints

Installation Process

Installing KB5002833 requires careful planning and execution:

Pre-Installation Steps

1. Create a complete SharePoint farm backup
2. Verify all SharePoint services are running
3. Ensure KB5001945 is installed
4. Schedule maintenance window for installation and testing

Installation Methods

Choose the appropriate installation method for your environment:

Automatic Updates

For environments with automatic updates enabled, KB5002833 will be installed automatically during the next maintenance cycle.

Manual Installation

Download the update package from Microsoft Update Catalog and run:

sts2019-kb5002833-fullfile-x64-glb.exe /quiet /norestart

PowerShell Installation

Use PowerShell for scripted deployment:

Add-SPShellAdmin -UserName "DOMAIN\InstallAccount"
Install-SPUpdate -Path "C:\Updates\sts2019-kb5002833-fullfile-x64-glb.exe"

Post-Installation Verification

After installation, verify the update was applied successfully:

Get-SPProduct -Local | Where-Object {$_.PatchableUnitDisplayNames -like "*KB5002833*"}

Impact Assessment

Organizations should assess the impact of this security update:

Security Benefits

• Eliminates critical remote code execution vulnerabilities
• Prevents privilege escalation attacks
• Blocks cross-site scripting exploits
• Protects sensitive configuration information

Operational Considerations

• Server restart required during installation
• SharePoint services unavailable during update process
• Custom solutions may require testing and updates
• Full search crawl recommended after installation