Patch SharePoint Toolshell Vulnerabilities & Verify Fixes

Updated 14 November 2026 · Standard formula, shown below

This guide walks through patching known vulnerabilities in the SharePoint Toolshell component (a legacy command-line utility) and verifying that the fixes are applied correctly. You’ll learn how to identify the affected version, download and install the official cumulative update, confirm the patch via version numbers and security checks, and validate that the Toolshell functionality still works as expected. Before starting, ensure you have administrative access to the SharePoint server and a maintenance window, as a restart of SharePoint services may be required.

What You’ll Need

Administrator access to the SharePoint server (local or farm admin).
The exact SharePoint version and build number (found via Central Administration or PowerShell).
Internet access to download the cumulative update from the Microsoft Download Center or your organization’s software distribution point.
A backup of the SharePoint databases and the server’s system state (recommended before applying any update).
Access to the SharePoint Management Shell (PowerShell with SharePoint snap-in).

Step-by-Step

Identify the current SharePoint build. Open the SharePoint Management Shell as administrator and run: Get-SPFarm | Select BuildVersion. Note the version number (e.g., 15.0.5233.1000 for SharePoint 2013). This tells you whether you are below the patched build.
Check for known Toolshell vulnerabilities. Review the Microsoft Security Update Guide for the specific CVE(s) affecting SharePoint Toolshell. These are typically remote code execution or elevation of privilege issues. The advisory will list the affected versions and the minimum build that includes the fix.
Download the correct cumulative update (CU). Go to the Microsoft Download Center and search for the latest cumulative update for your SharePoint version (e.g., “SharePoint Server 2016 Cumulative Update”). Download the .exe file that matches your architecture (x64). Ensure the update’s build number is equal to or higher than the minimum required by the advisory.
Back up your environment. Before installing, run a full backup of the SharePoint content databases, Central Administration content database, and the server’s system state. Also note the current build version for rollback purposes.
Run the update installer. Double-click the downloaded .exe. If prompted by User Account Control, click Yes. On the first screen, read the license terms, check “I accept the terms of this agreement,” and click Continue.
Choose the installation type. Select “Install now” (or “Upgrade”) to apply the patch. The installer will check prerequisites and may require the SharePoint services to be stopped. Allow it to proceed.
Wait for the installation to complete. The progress bar will show the installation status. This can take 30–60 minutes depending on the server. Do not interrupt the process.
Run the SharePoint Products Configuration Wizard. After the patch installs, the wizard may launch automatically. If not, open it from Start Menu > Microsoft SharePoint Products > SharePoint Products Configuration Wizard. Click Next, accept the warning, and let it run. This upgrades the farm’s configuration and updates the database schema.
Restart the server if prompted. Some updates require a reboot. If the installer or wizard asks to restart, do so before proceeding.
Verify the new build version. Reopen the SharePoint Management Shell and run Get-SPFarm | Select BuildVersion. Confirm that the version is now higher than the previous one and meets or exceeds the minimum from the security advisory.
Check the Toolshell file version. Navigate to the SharePoint root directory (typically C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\15\BIN for 2013, or 16 for 2016/2019). Right-click on tshell.exe (the Toolshell executable) and select Properties > Details. Note the File Version. It should match the build you just installed.
Run a security verification. Use the Microsoft Baseline Security Analyzer (MBSA) or the Microsoft Security Compliance Toolkit to scan the server. These tools will report whether the missing updates are now installed. Alternatively, check the Windows Update history for the KB number associated with the CU.
Test Toolshell functionality. Open a command prompt as administrator, navigate to the BIN directory, and run a simple Toolshell command to ensure it still works. For example: tshell.exe -help or tshell.exe -list. If it returns usage information or a list of features, the tool is operational.
Monitor the farm health. After the patch, review the SharePoint ULS logs and the Windows Event Viewer for any errors related to Toolshell or the update process. Also run a quick check of the timer service (via Central Administration) to ensure it’s running.
Document the change. Record the old and new build numbers, the KB number, and the date in your change log. This is essential for auditing and future troubleshooting.

Common Mistakes

Applying the wrong CU: Downloading a cumulative update for a different SharePoint version (e.g., 2013 instead of 2016) will fail or cause corruption. Always verify the version before downloading.
Skipping the configuration wizard: The patch installs binaries, but the farm must be upgraded via the wizard. Skipping this step leaves the farm in an inconsistent state.
Not backing up: If the update fails, you may need to restore the farm. Without a backup, you risk data loss.
Running Toolshell without admin rights: Toolshell requires elevated privileges for most operations. Running it as a standard user will result in access denied errors.
Assuming the patch is applied after the installer finishes: The installer may complete, but the wizard might fail. Always verify the build version and file versions.

Tips

Always download the CU from the official Microsoft Download Center or your VLSC portal, not from third-party sites.
Schedule the patch during a maintenance window, as the server will be unavailable during the installation and wizard run.
If you have a multi-server farm, apply the patch to all servers and run the wizard on each one, starting with the server that hosts Central Administration.
Use the Get-SPProductVersion PowerShell cmdlet to get a detailed list of installed product versions and verify the patch on each server.
Keep a copy of the CU installer and the KB article for reference in case you need to reapply or roll back.

Troubleshooting

The installer fails with an error. Check the installation log in the temp folder (e.g., %temp%\SharePoint Server Setup\). The log will indicate the cause. Common issues include insufficient disk space, missing prerequisites, or another update pending. Free up space, install prerequisites, and reboot before retrying.

The configuration wizard fails. If the wizard fails, check the ULS logs and the Windows Event Viewer. A common cause is a stopped service like the SharePoint Timer Service. Start the service and rerun the wizard. If it still fails, you may need to repair the farm using the SharePoint Products Configuration Wizard in repair mode.

Build version hasn’t changed. If Get-SPFarm shows the old version, the update may not have been applied to the server you’re checking. Apply the CU to that server and run the wizard. Also ensure you’re looking at the correct farm (if multiple farms exist).

Toolshell commands fail after patching. This could be due to permission changes or a corrupted installation. Try running tshell.exe from an elevated command prompt. If it still fails, check the file version; if it’s old, the patch didn’t install correctly. Reinstall the CU.

The security scan still shows the vulnerability. Ensure you installed the latest CU, not just a security-only update. Some advisories require a specific CU that includes the fix. Also verify that the scan is checking the correct server and that the update was applied to all servers in the farm.

Frequently Asked Questions

Q: What is SharePoint Toolshell? Toolshell (tshell.exe) is a legacy command-line utility used for administrative tasks like managing site collections and features. It’s not commonly used today but still exists in the SharePoint installation.

Q: How do I know if my SharePoint version is vulnerable? Check the Microsoft Security Update Guide for the specific CVE. It lists affected versions and the minimum build that contains the fix. Compare your build number from Get-SPFarm.

Q: Can I install the patch without running the configuration wizard? No. The wizard is required to upgrade the farm’s configuration and databases. Skipping it will leave the farm in an inconsistent state.

Q: Will this patch affect my custom solutions? Cumulative updates are designed to be backwards-compatible, but they can occasionally change behavior. It’s recommended to test custom solutions in a staging environment first.

Q: How long does the patch take? The installation itself may take 30–60 minutes, plus additional time for the configuration wizard. The total downtime can be 1–2 hours depending on the farm size.

Q: Can I roll back the patch? Yes, you can uninstall the CU from Control Panel > Programs and Features, but you must also restore the databases from backup if the schema was upgraded. Always plan for rollback before applying.

Method: the standard formula for this calculation, rounded as each result states. See how the calculators work or report an error.