Microsoft released its June 2026 security updates for on-premises SharePoint Server, closing a spoofing vulnerability tracked as CVE-2026-48560. The fix covers SharePoint Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition, and addresses a flaw that could let attackers impersonate legitimate components within a farm. The updates, urgently recommended by Microsoft, arrive alongside several other critical patches and require administrators to also update dependent Workflow Manager components.
The Patch: What’s Fixed and Where
CVE-2026-48560 is a spoofing vulnerability that affects how SharePoint Server validates trust relationships between farm components. Microsoft has not released detailed technical information, but the June 9 advisory confirms the issue is serious enough to warrant patches across all supported on-premises versions. The exact updates are:
- SharePoint Server 2016: KB5002880, updating the build to 16.0.5556.1005.
- SharePoint Server 2019: KB5002874.
- SharePoint Server Subscription Edition: KB5002873, build 16.0.19725.20360. This update also introduces the Version 26H1 feature update for the subscription channel.
These are cumulative updates, meaning they bundle all previous fixes with the new security patches. Rolling them out requires a full farm upgrade—partial updates can break functionality and leave gaps.
Who’s Affected and How
Anyone running an on-premises SharePoint farm that hasn’t applied the June 2026 updates is affected. The impact could range from subtle data manipulation to more overt impersonation attacks. Because SharePoint sits at the heart of document management, workflows, and authentication, a spoofing breach can undermine trust in the entire collaboration platform.
Home users aren’t directly affected—this is strictly a server-side issue for organizations. IT administrators, however, must act quickly. The risk is highest for farms accessible from the internet, but even internal-only deployments aren’t safe; attackers who gain network access can leverage spoofing to move laterally, trick users, or alter sensitive content.
Developers who maintain custom web parts or workflows need to verify that the June updates don’t break their code. The Workflow Manager prerequisite is a particular pain point: if your farm uses Workflow Manager, you must install that component’s update before the SharePoint cumulative update. Farms still on the classic Workflow Manager must enable a debug flag to keep it running.
Why This Spoofing Flaw Matters
Spoofing vulnerabilities are often downplayed because they don’t directly grant remote code execution. But in SharePoint, trust is the foundation of everything. The platform tells users who authored a document, which workflow step is pending, and whether a search result is authoritative. If an attacker can spoof that information, they can corrupt business processes, redirect approvals, or plant falsified data without leaving obvious footprints.
This CVE landed in a month dense with SharePoint patches. The June 9 update bundle for Subscription Edition, for example, resolves multiple remote code execution and spoofing issues. Administrators can’t cherry-pick fixes; they must bring the entire farm to the new security baseline. That means ignoring CVE-2026-48560 also leaves other, more critical gaps open.
Microsoft’s advisory confirms the vulnerability exists and is fixed, which tips off attackers. Patch reverse-engineering often leads to working exploits within days. The lack of public technical detail isn’t a reason to delay—it’s a warning that the clock is ticking.
How We Got Here
On-premises SharePoint has been a constant target. Over the years, vulnerabilities like CVE-2023-29357, CVE-2023-24955, and CVE-2024-21318 have exposed farms to remote code execution and privilege escalation. Microsoft’s security posture has shifted heavily toward cloud, but organizations stuck with on-prem for compliance, customization, or legacy reasons still run large, complex farms.
The June 2026 patch cycle continues a pattern of monthly SharePoint updates that demand more than just running Windows Update. Farms often require sequenced patching: front-end servers, application servers, search components, and workflow engines. The Workflow Manager dependency is a hangover from older architectures. Many farms still rely on classic workflows built years ago, and each security update tests whether the house of cards will stand.
Microsoft has been moving SharePoint Server Subscription Edition toward a more modern model, with feature updates like 26H1, but the patching burden remains squarely on the customer. That reality collides with shrinking IT budgets and the lingering perception that SharePoint is just an internal website, not a critical security asset.
What to Do Now
If you manage a SharePoint farm, take these steps immediately:
- Inventory your environment. Identify every server running SharePoint 2016, 2019, or Subscription Edition. Note build numbers, farm topology, and whether Workflow Manager is active.
- Check prerequisites. For SharePoint 2016 and 2019 with Workflow Manager, download and install the corresponding Workflow Manager update first. For classic Workflow Manager, follow Microsoft’s debug-flag instructions.
- Stage the update. Test in a non-production farm that mirrors your configuration. Document any customizations that break and prepare fixes or workarounds.
- Apply the cumulative update to all servers in the correct order (usually starting with the server hosting Central Administration, but follow Microsoft’s documentation). Run the SharePoint Products Configuration Wizard after installing.
- Validate. Confirm the new build numbers on each server. Test critical workflows, search, and document access.
- Monitor logs. Keep an eye on ULS, event logs, and IIS logs for unexpected errors in the days following the update.
- Plan for rollback. Have a snapshot or backup ready in case the update causes a major outage. Know how to uninstall the update and restore the previous build.
If your farm is internet-facing, prioritize this patch above all else. If it’s internal, still aim for completion within a week—the risk of lateral movement from a compromised endpoint is real.
For organizations that can’t patch immediately due to business-critical workflows, implement compensating controls: restrict network access to the farm, disable unnecessary services, enable enhanced logging, and monitor for anomalous behavior. But treat this as a temporary measure only.
The Bigger Picture: On-Premises in 2026
CVE-2026-48560 is more than a single patch release. It’s a reminder that on-premises SharePoint remains a sprawling, often fragile asset that demands constant attention. The platform’s complexity means every update is a project. The Workflow Manager caveat illustrates the hidden costs of technical debt—many admins don’t even know if they’re running Workflow Manager, let alone which version.
Microsoft’s sparse advisories force defenders to interpret risk based on context rather than detail. That’s not going to change. The organizations that fare best will be those with robust patch processes, good inventory, and the willingness to treat SharePoint as the identity-era security system it has become.
Going forward, expect more spoofing and data integrity flaws to surface as attackers shift focus from code execution to stealthier, trust-based attacks. The June 2026 patches are just one chapter. The next Patch Tuesday could bring another zero-day, another farm-wide scramble. The question isn’t whether your farm can handle today’s update—it’s whether your team can handle the next one.