SharePoint Server: Fix 17 Vulnerabilities with KB5002908

September 2026 brings no major product updates, but it requires urgent action from every administrator running on-premises SharePoint Server: installing the KB5002908 security patch. This article guides you step by step through deploying this critical security patch, then reviews other developments for the month — Copilot governance, Purview, Intune, and licensing — helpful if you manage multiple Microsoft 365 tenants.

Why This September Patch Comes Before Everything Else

Microsoft released the KB5002908 security patch for SharePoint Server Subscription Edition on September 8, 2026, advancing the build to 16.0.20326.20136. It fixes 17 vulnerabilities covering information disclosure, remote code execution (RCE), spoofing, and privilege escalation, including CVE-2026-69465, CVE-2026-69690, and CVE-2026-69724.

Unlike typical monthly product announcements, this patch is neither optional nor cosmetic: an RCE vulnerability on an exposed SharePoint Server can grant complete access to the infrastructure hosting business content. If you administer even one on-premises SharePoint Server farm, this patch must become your top priority.

The patch does more than patch vulnerabilities: it also disables the SOAP GetDataFromDataSourceControl functionality and deprecates ExecuteProxyUpdates, SharePoint 2010 workflow, and the ToolPane feature. Any customization relying on these components will stop working after installation.

Prerequisites Before Starting Deployment

Before touching a production server, gather the following:

• An account with the Farm Administrator role on the SharePoint Server Subscription Edition farm in question.
• Local administrator access on each server to run installation and psconfig.
• A complete backup (content databases, configuration, certificates) dated less than 24 hours ago.
• Verification that SharePoint Workflow Manager is present: if installed, patch KB5002799 must be applied first, otherwise KB5002908 will fail or break the workflow.
• An inventory of customizations using ToolPane, ExecuteProxyUpdates, GetDataFromDataSourceControl, or SharePoint 2010 workflows.
• A sufficient maintenance window: the patch requires service restarts and farm configuration execution on each server.
• Ideally, a test environment or pilot server outside production to validate behavior before general deployment.

Deploy KB5002908 Step by Step

Verify the Patch Is Properly Installed

In SharePoint Administration Center, go to Central Administration > Upgrades and Migration > Check upgrade status to confirm the farm reports version 16.0.20326.20136 without pending errors.

You can also query the farm directly in PowerShell, from the SharePoint Management Shell:

1# Display current SharePoint farm build version
2(Get-SPFarm).BuildVersion.ToString()

The expected result is 16.0.20326.20136. If a server shows an earlier build, installation or psconfig execution on that server did not complete properly.

Implementation: Audit Multiple SharePoint Farms in One Pass

If you manage SharePoint Server for multiple customers, this script remotely queries each farm to confirm the patch is applied everywhere, without connecting to servers one by one.

Prerequisites: PowerShell Remoting enabled on remote servers, account with local administrator rights on each target server, and SharePoint Management Shell installed on the servers themselves (provided with SharePoint Server installation).

1# List of SharePoint front-end servers to audit, one per customer or farm
2$serveurs = @("SPFARM-CLIENT-A", "SPFARM-CLIENT-B", "SPFARM-CLIENT-C")
3 
4# Target build after KB5002908 application
5$buildCible = "16.0.20326.20136"
6 
7$resultats = foreach ($serveur in $serveurs) {
8    try {
9        $build = Invoke-Command -ComputerName $serveur -ScriptBlock {
10            # The SharePoint snap-in must be loaded to use Get-SPFarm
11            Add-PSSnapin Microsoft.SharePoint.PowerShell -ErrorAction SilentlyContinue
12            (Get-SPFarm).BuildVersion.ToString()
13        } -ErrorAction Stop
14 
15        [PSCustomObject]@{
16            Serveur       = $serveur
17            BuildActuelle = $build
18            Conforme      = ($build -eq $buildCible)
19        }
20    }
21    catch {
22        # Server unreachable or command failed
23        [PSCustomObject]@{
24            Serveur       = $serveur
25            BuildActuelle = "Connection error"
26            Conforme      = $false
27        }
28    }
29}
30 
31# Display on screen and export for customer-by-customer archival
32$resultats | Format-Table -AutoSize
33$resultats | Export-Csv -Path "C:\Reports\Audit-KB5002908.csv" -NoTypeInformation -Encoding UTF8

This script produces a summary table on screen and a usable CSV file to prove, farm by farm, that the patch was properly applied — useful for security audits or customer reporting.

Troubleshooting

Classic workflow stops after the patch: Verify that the required PowerShell debug setting for Classic Workflow Manager was enabled after installation. This is the most common error when step 5 of the procedure is skipped.

psconfig fails with configuration database error: If Workflow Manager is present and KB5002799 was not installed before KB5002908, psconfig execution may fail or leave the farm in an inconsistent state. Reinstall KB5002799, rerun psconfig, then check upgrade status again.

Customizations stop working after the patch: If a solution relied on GetDataFromDataSourceControl, ExecuteProxyUpdates, ToolPane, or SharePoint 2010 workflow, there is no simple workaround — these features are disabled or deprecated by the patch. Remediation requires rewriting the customization, not reactivating a setting.

Other M365 Projects in September 2026 Not to Miss

Intune: Less Friction on Multi-Tenant Fleets

• Remote Help without supervision (Physical Windows, week of August 25): a technician can take control of a workstation without user validation, useful for out-of-hours support.
• New single device page, enabled by default in Intune Administration Center: properties, hardware, remote actions, and remediation gathered in a single view, with option to switch to the old layout.
• operatingSystemVersion filter in general availability: target assignments by OS version or build range, useful for standardizing progressive deployments across customers.
• Audit mode for Defender Antivirus on Linux: detection without automatic quarantine, practical for evaluating coverage before enabling full protection.

Purview: Data Protection Extends Beyond Microsoft

• DLP in preview: data loss prevention policies now protect sensitive data at rest in Box and Google Workspace, via existing Defender for Cloud Apps connectors.
• Simulation mode for automatic labeling: preview label matches via a new Insights tab before actually activating a labeling policy.

Copilot: Governance Continues to Tighten

• Files generated by Copilot automatically inherit the highest sensitivity label found in source data, with an alert to the user if the label could not be applied.
• Federated Copilot connectors, based on the MCP protocol (Model Context Protocol), are now managed from the Connectors tab in Microsoft 365 Administration Center.
• Agents created in Agent Builder now require administrator approval before publishing to the "Created by your organization" section of the Agent Store.
• Viva Insights offers a new consumption dashboard to track Copilot credits (Cowork, API Work IQ), accessible to managers of at least five direct reports, insights analysts, and global administrators — provided usage-based billing is already configured via Cost Management.

Licensing: Power Apps Price Increase to Anticipate

Microsoft confirmed a $2 USD per user per month increase on both Power Apps Premium plans, effective January 1, 2027. Existing subscriptions retain current pricing through the end of their current term.

This is the first price increase on these two references in over five years; other Power Apps and Power Platform products remain unchanged. If customers renew at the start of the calendar year, it is better to factor in this increase now than discover it on the invoice.

Key Takeaways and Monday Morning Action Items

Prioritize KB5002908 on every SharePoint Server Subscription Edition farm you administer: audit dependencies on deprecated features, install KB5002799 if Workflow Manager is present, backup, test on a pilot server, then deploy across the entire farm.

In parallel, verify that administrator approval for Copilot agents is enabled on each tenant, and that your DLP policies now cover non-Microsoft applications if your environment is hybrid. If customers renew Power Apps Premium after January 1, 2027, factor the price increase into their budget at the next renewal conversation rather than upon invoice receipt.