KB5002841

Description of the security update for SharePoint Server 2016: February 10, 2026 (KB5002841)

Applies To

SharePoint Server 2016

Summary

Important:

• If you're currently running SharePoint Workflow Manager, you must install the SharePoint Workflow Manager (KB5002799) to your farm before you install this cumulative update.

• If you're currently running the Classic version of Workflow Manager, you have to enable the debug flag in order to continue using it. :

$farm = Get-SPFarm

$farm.ServerDebugFlags.Add(53601)

$farm.update()

iisreset

This security update resolves Microsoft Word spoofing vulnerability and Microsoft Outlook spoofing vulnerability. To learn more about the vulnerabilities, see the following security advisories:

• Microsoft Common Vulnerabilities and Exposures CVE-2026-21511

• Microsoft Common Vulnerabilities and Exposures CVE-2026-21260

Notes:

• This is build 16.0.5539.1002 of the security update package.

• To apply this security update, you must have the release version of Microsoft SharePoint Server 2016 installed on the computer.

This public update delivers Feature Pack 2 for SharePoint Server 2016. Feature Pack 2 contains the following feature:

• SharePoint Framework (SPFx)

This public update also delivers all the features that were included in Feature Pack 1 for SharePoint Server 2016, including:

• Administrative Actions Logging

• MinRole enhancements

• SharePoint Custom Tiles

• Hybrid Taxonomy

• OneDrive API for SharePoint on-premises

• OneDrive for Business modern user experience (available to Software Assurance customers)

The OneDrive for Business modern user experience requires an active Software Assurance contract at the time...