KB5002873: Microsoft SharePoint Server 2019 Security Update (July 2026)

A newer security update for Microsoft SharePoint Enterprise Server 2016 has shipped since this one: KB5002882 (2026-08-11). For cumulative update families the newer package includes these fixes, so installing that one is usually the shorter path. Verify against your own update rings before you skip this package.

We checked Microsoft's support article for KB5002873 on 2026-08-11 and it lists no known issues. Read the article before broad deployment; Microsoft adds issues as reports come in, and we re-check on every refresh.

KB5002873 patches 31 CVEs across SharePoint Enterprise Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition, topped by a Critical flaw rated CVSS 9.8. One of these CVEs is already on the CISA Known Exploited Vulnerabilities list, meaning attackers are actively using it against on-premises SharePoint farms, though none is currently tied to ransomware. The highest EPSS score is 27 percent, which is elevated for a freshly disclosed set and reinforces that exploitation is realistic near term.

Do this: Apply KB5002873 to all on-premises SharePoint 2016, 2019, and Subscription Edition farms now, prioritizing the internet-facing servers exposed to the KEV-listed CVE.

AI-generated from public data, 2026-07-26. Verify against the vendor advisory before acting.