Windows Server patches breaking Exchange

Posted on October 15, 2026 by Michel de Rooij

A heads-up not directly related to the October Exchange SUs, but important if you run Exchange on-premises: Reports indicate that last Tuesday’s Windows Server patches could break Exchange functionality.

The Windows Server updates that might cause issues are:

Reported issues include Outlook Web Access (OWA) failures, mail flow disruptions, and growing mail queues. Also, the following event might be logged in the Application event log:

Source: MSExchange Replication Service
Event ID: 1006
Description: The Microsoft Exchange Mailbox Replication service was unable to process jobs in a mailbox database.
Database: <Mailbox DB>
Error: MapiExceptionMdbOffline: Unable to make connection to the server. (hr=0x80004005, ec=1142).

After installing the Windows Server update, the Exchange Back End website (the one listening on 0.0.0.0:444) appears to lose its binding to the WMSVC-SHA2-<Server Name> certificate. This self-signed WMSVC certificate is used by the Web Management service to enable remote management of the web server and its associated web sites and applications, e.g., Exchange Server.

You could rebind this certificate to WMSvc (port 8172) using the following procedure, provided you have the Web Administration PowerShell module installed:

			
Import-Module WebAdministration
$cert= Get-ChildItem Cert:\LocalMachine\My | Where { $_.Subject -eq ('CN=WMSvc-SHA2-{0}') -f $ENV:COMPUTERNAME}
Remove-Item -Path IIS:\SslBindings\0.0.0.0!8172
New-Item -Path IIS:\SslBindings\0.0.0.0!8172 -Value $cert  -Force
Restart-Service WMSvc

		

Microsoft is investigating the issue.

Security Updates Exchange 2016-SE (Oct2026)

Posted on October 13, 2026 by Michel de Rooij

The Exchange product group released the October 2026 updates for Exchange Server SE, Exchange 2019, and Exchange 2016. The Security Update for Exchange SE is publicly available. Security updates for Exchange 2019 and Exchange 2016 are available to organizations enrolled in the Extended Security Update Period 2 program.

Note: These are the final Security Updates for Exchange 2016 and Exchange 2019. As of now, Microsoft will not test Exchange 2019 or Exchange 2016 for new CVEs, and they will not receive any further SUs. The ESU2 program will be available for a while, but it will only bring you up to the October 2026 SU level.

The vulnerabilities addressed in these Security Updates are:

Vulnerability	Category	Severity	Rating
CVE-2026-70571	Remote Code Execution	Critical	CVSS:3.1 8.1 / 7.1
CVE-2026-77910	Elevation of Privilege	Important	CVSS:3.1 8.8 / 7.7
CVE-2026-87692	Elevation of Privilege	Important	CVSS:3.1 7.8 / 6.8
CVE-2026-87695	Elevation of Privilege	Important	CVSS:3.1 7.8 / 6.8
CVE-2026-87696	Elevation of Privilege	Important	CVSS:3.1 7.5 / 6.5
CVE-2026-70279	Spoofing Vulnerability	Important	CVSS:3.1 9.3 / 8.1

The Security Updates for each supported Exchange Server build are linked below:

Exchange	HU/Su	Download	Build	KB	Supersedes
Exchange SE	11	Download	15.2.2562.56	KB5128895	KB5129955
Exchange 2019 CU15	12	ESU2	15.2.1748.55	KB5128896	KB5129956
Exchange 2019 CU14	15	ESU2	15.2.1544.50	KB5128897	KB5129957
Exchange 2016 CU23	26	ESU2	15.1.2507.77	KB5128898	KB5129958

Issues resolved

Notes

Security updates are specific to the Cumulative Update level. You cannot apply the Exchange 2019 CU15 security update to Exchange 2019 CU14. When downloading, the security update may have the same name across different Cumulative Updates. Microsoft now includes the KB article number as a reference, but I still tag the filename with the CU level for archival purposes, e.g., Exchange2019-CU15-KBxxxxxxx-x64-en.exe.
Like Cumulative Updates, Security Updates are cumulative, and you only need to install the latest SU for your CU.
If you deployed Exchange Management Tools to manage your on-premises Exchange Servers, or installed the tools after removing the Last Exchange Server for recipient management, we recommend applying the Security Update.

Finally, as with any patch or update, test it in a test environment before deploying it to production. However, we do not recommend waiting for regular maintenance cycles for security updates; a more agile approach is preferable, and the ratings indicate the urgency level.

V2 Security Updates Exchange 2016-SE (Sep2026)

Posted on October 3, 2026 by Michel de Rooij

The Exchange product group released an update for the September 2026 updates for Exchange Server SE, Exchange 2019, and Exchange 2016. The Security Update for Exchange SE is publicly available. Security updates for Exchange 2019 and Exchange 2016 are available to organizations enrolled in the Extended Security Update Period 2 program.

The vulnerability addressed in these V2 Security Updates for Exchange Server is:

Vulnerability	Category	Severity	Rating
CVE-2026-96940	Elevation of Privilege	Important	CVSS:3.1 8.8 / 7.7

To clarify: The V2 security updates address this CVE in addition to the CVE addressed by the original September Security Updates. Known Issues and Fixed Issues from the original September Security Updates also apply to V2.

The V2 Security Updates for each supported Exchange Server build are linked below:

Exchange	HU/Su	Download	Build	KB	Supersedes
Exchange SE	10v2	Download	15.2.2562.53	KB5129955	KB5121608
Exchange 2019 CU15	11v2	ESU2	15.2.1748.53	KB5129956	KB5121609
Exchange 2019 CU14	14v2	ESU2	15.2.1544.48	KB5129957	KB5121610
Exchange 2016 CU23	25v2	ESU2	15.1.2507.75	KB5129958	KB5121611

Known Issues

ContentEngine deadlock because of missing Korean WordBreaker rule files

Notes

Security updates are specific to the Cumulative Update level. You cannot apply the Exchange 2019 CU15 security update to Exchange 2019 CU14. When downloading, the security update might carry the same name for different Cumulative Updates. Microsoft now includes the KB article number as a reference, but I still tag the filename with the CU level for archival purposes, e.g., Exchange2019-CU15-KBxxxxxxx-x64-en.exe.
Like Cumulative Updates, Security Updates are cumulative, and you only need to install the latest SU for your CU.
Suppose you have deployed Exchange Management Tools to manage your on-premises Exchange Servers or installed the tools after removing the Last Exchange Server for recipient management. We recommend applying the Security Update.

Security Updates Exchange 2016-SE (Sep2026)

Posted on September 8, 2026 by Michel de Rooij

The Exchange product group released the September 2026 updates for Exchange Server SE, Exchange 2019, and Exchange 2016. The Security Update for Exchange SE is publicly available. Security updates for Exchange 2019 and Exchange 2016 are available to organizations enrolled in the Extended Security Update Period 2 program.

The vulnerabilities addressed in these Security Updates for Exchange Server are:

Vulnerability	Category	Severity	Rating
CVE-2026-55007	Remote Code Execution	Important	CVSS:3.1 8.1 / 7.1
CVE-2026-69355	Remote Code Execution	Important	CVSS:3.1 8.8 / 7.7
CVE-2026-69356	Spoofing	Important	CVSS:3.1 9.3 / 8.1
CVE-2026-69361	Spoofing	Important	CVSS:3.1 6.5 / 5.7
CVE-2026-69375	Tampering	Important	CVSS:3.1 6.5 / 5.7
CVE-2026-69378	Denial of Service	Important	CVSS:3.1 7.5 / 6.5
CVE-2026-69380	Elevation of Privilege	Important	CVSS:3.1 8.1 / 7.1
CVE-2026-69382	Information Disclosure	Important	CVSS:3.1 5.9 / 5.2
CVE-2026-69641	Elevation of Privilege	Important	CVSS:3.1 9.1 / 7.9

Note: CVE-2026-55007 does not apply to Exchange Server 2016.

The Security Updates for each supported Exchange Server build are linked below:

Exchange	SU/HU	Download	Build	KB	Supersedes
Exchange SE	10	Download	15.2.2562.49	KB5121608	KB5121573
Exchange 2019 CU15	11	ESU2	15.2.1748.51	KB5121609	KB5121574
Exchange 2019 CU14	14	ESU2	15.2.1544.46	KB5121610	KB5121575
Exchange 2016 CU23	25	ESU2	15.1.2507.73	KB5121611	KB5121576

Fixed Issues

The SU resolves the following issues from previous updates:

Known Issues

Be aware of the following known issue after installing the SU:

Published calendar (.ics) returns HTTP 500 for calendar applications | Microsoft Support

Notes

Security updates are specific to the Cumulative Update level. You cannot apply the Exchange 2019 CU15 security update to Exchange 2019 CU14. When downloading, the security update might carry the same name for different Cumulative Updates. Microsoft now includes the KB article number as a reference, but I still tag the filename with the CU level for archival purposes, e.g., Exchange2019-CU15-KBxxxxxxx-x64-en.exe.
Like Cumulative Updates, Security Updates are cumulative, and you only need to install the latest SU for your CU.
Suppose you have deployed Exchange Management Tools to manage your on-premises Exchange Servers or installed the tools after removing the Last Exchange Server for recipient management. We recommend applying the Security Update.

Security Updates Exchange 2016-SE (Aug2026)

Posted on August 11, 2026 by Michel de Rooij

The Exchange product group released the Augustus 2026 updates for Exchange Server SE, as well as Exchange 2019 and 2016. The Security Update for Exchange SE is available to the public. Security updates for Exchange 2019 and Exchange 2016 are available to organizations enrolled in the Extended Security Update Period 2 program.

The vulnerabilities addressed in these Security Updates for Exchange Server are:

Vulnerability	Category	Severity	Rating
CVE-2026-65813	Elevation of Privilege	Important	CVSS:3.1 6.5 / 5.7
CVE-2026-62915	Security Feature Bypass	Important	CVSS:3.1 6.5 / 5.7
CVE-2026-62914	Spoofing	Important	CVSS:3.1 7.3 / 6.4
CVE-2026-62913	Remote Code Execution	Important	CVSS:3.1 8.8 / 7.7
CVE-2026-62912	Denial of Service	Important	CVSS:3.1 6.5 / 5.7
CVE-2026-62911	Elevation of Privilege	Important	CVSS:3.1 8.0 / 7.0
CVE-2026-62910	Elevation of Privilege	Critical	CVSS:3.1 7.2 / 6.3
CVE-2026-55009	Elevation of Privilege	Important	CVSS:3.1 7.8 / 6.8

The Security Updates for each supported Exchange Server build are linked below:

Exchange	SU/HU	Download	Build	KB	Supersedes
Exchange SE	9	Download	15.2.2562.46	KB5121573	KB5103212
Exchange 2019 CU15	10	ESU Period 2	15.2.1748.49	KB5121574	KB5103213
Exchange 2019 CU14	13	ESU Period 2	15.2.1544.44	KB5121575	KB5103214
Exchange 2016 CU23	24	ESU Period 2	15.1.2507.72	KB5121576	KB5103215

Known Issue

Be aware of the following issue after installing these SU:

Wrapper messages appear in shared mailbox in hybrid environments after installing the June 2026 Security Update

OWA Light

Starting with this SU, the OWA Light client will be permanently disabled. See related CVE-2026-62914 for more information. If you cannot install the August SU for some reason, it is recommended to disable OWA Light manually, e.g.

# To disable OWA Light in applicable Mailbox Policies
Set-OwaMailboxPolicy -OwaLightEnabled $false

# To disable OWA Light option in the OWA interface
Set-OwaVirtualDirectory -LogonPageLightSelectionEnabled $false

Notes

Security updates are specific to the Cumulative Update level. You cannot apply the Exchange 2019 CU15 security update to Exchange 2019 CU14. When downloading, the security update might carry the same name for different Cumulative Updates. Nowadays, Microsoft includes the KB article number as a reference, but I would still tag the filename with the CU level for archival purposes, e.g., Exchange2019-CU15-KBxxxxxxx-x64-en.exe.
Like Cumulative Updates, Security Updates are cumulative, and you only need to install the latest SU for your CU.
Suppose you have deployed Exchange Management Tools to manage your on-premises Exchange Servers or installed the tools after removing the Last Exchange Server for recipient management. It is recommended that you apply the Security Update.

On a final note, as with any patch or update, it is recommended that you test it in a test environment before deploying it to production. However, it is not recommended to wait for regular maintenance cycles for security updates; a more agile approach is preferable, and the ratings indicate the urgency level.