Microsoft · Security update · January 13, 2026

KB5002828: January 2026 security update

KB5002828, released January 13, 2026, fixes 6 CVEs in Microsoft SharePoint Enterprise Server 2016. None of them is reported as exploited. Patch Radar priority: High. The product is no longer supported.

HighUnsupported product
CVEs closed
6
None rated Critical
Exploited
0
None reported
Exploitation more likely
0
Vendor assessment
Highest EPSS
0.1844
97th percentile

Priority of the 6 CVEs

Patch now 0 Urgent 0 High 4 Routine 2

Applies to

Product
Microsoft SharePoint Enterprise Server 2016

CVEs this fix closes

PriorityCVEComponentImpactCVSSEPSSExploitation
High CVE-2026-20947 Microsoft Office SharePoint Remote Code Execution 8.8 0.1844 Exploitation Unlikely
High CVE-2026-20951 Microsoft Office SharePoint Remote Code Execution 7.8 0.0079 Exploitation Less Likely
High CVE-2026-20943 Microsoft Office Remote Code Execution 7.0 0.0065 Exploitation Less Likely
High CVE-2026-20948 Microsoft Office Word Remote Code Execution 7.8 0.0060 Exploitation Less Likely
Routine CVE-2026-20959 Microsoft Office SharePoint Spoofing 4.6 0.0768 Exploitation Less Likely
Routine CVE-2026-20958 Microsoft Office SharePoint Information Disclosure 5.4 0.0035 Exploitation Less Likely
Showing 1 to 6 of 6 1