The Exchange product group released October updates for Exchange Server 2016 and 2019.

The vulnerabilities addressed in these Security Updates for Exchange Server are:

Vulnerability	Category	Severity	Rating
CVE-2023-36726	Elevation of Privilege	Important	CVSS:3.1 7.8 / 6.8
CVE-2023-36780	Remote Code Execution	Important	CVSS:3.1 7.2 / 6.3
CVE-2023-36778	Remote Code Execution	Important	CVSS:3.1 8.0 / 7.0

The Security Updates for each supported Exchange Server build are linked below:

Exchange	Download	Build	KB	Supersedes
Exchange 2019 CU13	Download	15.2.1258.27	KB5030877	KB5030524
Exchange 2019 CU12	Download	15.2.1118.39	KB5030877	KB5030524
Exchange 2016 CU23	Download	15.1.2507.34	KB5030877	KB5030524

TokenCacheModule

The recommendation for the August updates was to disable the TokenCacheModule in IIS to mitigate an Elevation of Privilege issue in IIS. That issue is fixed with a Windows update for CVE-2023-36434. Thus, after installing this update for IIS, it is no longer recommended to disable TokenCacheModule. When you have disabled it after installing the August 2023 updates, you can enable it again using New-WebGlobalModule -Name "TokenCacheModule" -Image "%windir%\System32\inetsrv\cachtokn.dll", or use the CVE-2023-21709.ps1 script specifying the -Rollback switch to (re-)enable it on all of your Exchange servers.

Fixed Issues

Apart from security fixes, these Security Updates also correct the following issues:

Issue Fixed	Exchange 2016	Exchange 2019
Users in account forest can’t change expired password in OWA in multi-forest Exchange deployments after installing August 2023 SU	Yes	Yes
Details Templates Editor fails and returns BlockedDeserializeTypeException	Yes	Yes
Extended Protection causes Outlook for Mac to fail to download the OAB (use updated Extended Protection script)	Yes	Yes

Notes

• Security updates are Cumulative Update level specific. You cannot apply the update for Exchange 2019 CU13 to Exchange 2019 CU12. When downloading, the security update will carry the same name for different Cumulative Updates, and I would suggest tagging the file name with the CU level when archiving it, e.g., Exchange2019-CU13-KBXXXXXX-x64-en.msp.
• Similar to Cumulative Updates, Security Updates are cumulative, and you only need to install the latest SU for your CU.
• If you have installed the Exchange Management Tools separately for managing your on-premises Exchange Servers or installed it after removal of the Last Exchange Server for recipient management, it is recommended to apply the Security Update.

On a final note, as with any patch or update, it is recommended to apply this in a test environment first prior to implementing it in production. However, it is not recommended to wait for regular maintenance cycles when it concerns security updates and follow a more agile approach; the ratings are an indication of the urgency.