KB5002768: Microsoft SharePoint Server 2019 Security Update (July 2025)

Update summary

Take a look before you deploy: this update has a known issue

Microsoft's own support article for KB5002768 documents the following, as of 2026-08-04.

• Users may experience an issue when loading some SharePoint page resources, and the following error message is logged in the SharePoint Unified...

Read the full known issues  ·  Microsoft's article

Senserva AI Opinion for KB5002768

Rounding out the SharePoint ToolShell fix set from July 8, 2025, this package also resolves CVE-2025-53771 and CVE-2025-53770 for SharePoint Enterprise Server 2016, SharePoint Server 2019, and Subscription Edition, at the same Critical, CVSS 9.8, 100 percent EPSS, CISA KEV, and ransomware-linked profile as the rest of the family. With five related packages patching the identical vulnerability pair, the priority is coverage: every SharePoint server in the farm needs one of them.

Do this: Audit the whole SharePoint farm to confirm every server has one of the ToolShell fix packages installed, including this one.

AI-generated from public data, 2026-07-07. Verify against the vendor advisory before acting.

Full tracking and change history for KB5002768

Senserva began recording day-to-day change history on 2026-07-07, and refreshes it several times a day. Release dates are historical where Microsoft publishes them; revision history is tracked from that date forward, so it does not include changes made before then.

Exploitation and severity

Fixes 2 CVEs. At least one is actively exploited (CISA KEV). Most severe CVSS 9.8 (Critical). EPSS exploit probability up to 100%. One is linked to ransomware.

Among the top 5% of tracked Microsoft updates by EPSS exploit probability.

What to do

Treat as urgent: it is being exploited in the wild (CISA KEV), so patch ahead of items that are not. Senserva flags whether KB5002768 is missing on your devices.

Check if KB5002768 is installed

Copy-paste PowerShell: one machine, or your whole estate in one pass. No output means the update is not installed.

Get-HotFix covers Windows updates. Office, SharePoint, and Exchange server updates show under installed updates in Programs and Features, or check the Update Catalog history.

Known issues, from Microsoft

Quoted from Microsoft's support article for KB5002768 (checked 2026-08-04). Verify against the article before acting.

Users may experience an issue when loading some SharePoint page resources, and the following error message is logged in the SharePoint Unified Logging System (ULS) logs:

Note

[SPRequestModule.PostAuthenticateRequestHandler] Risky signout bypass limited (Access Denied). request path: '<resource path>'.

To work around this issue, farm administrators can add the resource path in the AllowList by running the following PowerShell commands:

$farm = get-spfarm

​​​​​​​ $farm.AddGenericAllowedListValue("SignOutRefererAllowList", "<resource path>")

$farm.Update()

iisreset

To check whether the resource path exists in the AllowList, run:

$farm.ContainsGenericAllowedListValue("SignOutRefererAllowList", "<resource path>")

To remove the resource path from the AllowList, run:

$farm.RemoveGenericAllowedListValue("SignOutRefererAllowList", "<resource path>")

Note

Make sure that the resource path is valid and as expected before you follow the instructions to configure it.

CVEs fixed by this update

Sorted exploited-first, then by CVSS. Every CVE links to its Senserva page with the full risk facts, references, and a ready-to-paste AI prompt.

Affected products

• Microsoft SharePoint Enterprise Server 2016
• Microsoft SharePoint Server 2019
• Microsoft SharePoint Server Subscription Edition

Also released in July 2025

The highest-risk updates from the same release:

The full month, summarized: Microsoft Patch Tuesday.

Authoritative references