The Exchange product group released the September 2026 updates for Exchange Server SE, Exchange 2019, and Exchange 2016. The Security Update for Exchange SE is publicly available. Security updates for Exchange 2019 and Exchange 2016 are available to organizations enrolled in the Extended Security Update Period 2 program.

The vulnerabilities addressed in these Security Updates for Exchange Server are:

Vulnerability	Category	Severity	Rating
CVE-2026-55007	Remote Code Execution	Important	CVSS:3.1 8.1 / 7.1
CVE-2026-69355	Remote Code Execution	Important	CVSS:3.1 8.8 / 7.7
CVE-2026-69356	Spoofing	Important	CVSS:3.1 9.3 / 8.1
CVE-2026-69361	Spoofing	Important	CVSS:3.1 6.5 / 5.7
CVE-2026-69375	Tampering	Important	CVSS:3.1 6.5 / 5.7
CVE-2026-69378	Denial of Service	Important	CVSS:3.1 7.5 / 6.5
CVE-2026-69380	Elevation of Privilege	Important	CVSS:3.1 8.1 / 7.1
CVE-2026-69382	Information Disclosure	Important	CVSS:3.1 5.9 / 5.2
CVE-2026-69641	Elevation of Privilege	Important	CVSS:3.1 9.1 / 7.9

Note: CVE-2026-55007 is not addressed in the Exchange Server 2016 SU.

The Security Updates for each supported Exchange Server build are linked below:

Exchange	SU/HU	Download	Build	KB	Supersedes
Exchange SE	10	Download	15.2.2562.49	KB5121608	KB5121573
Exchange 2019 CU15	11	ESU2	15.2.1748.51	KB5121609	KB5121574
Exchange 2019 CU14	14	ESU2	15.2.1544.46	KB5121610	KB5121575
Exchange 2016 CU23	25	ESU2	15.1.2507.73	KB5121611	KB5121576

Fixed Issues

The SU resolves the following issues from previous updates:

• Wrapper messages appear in shared mailbox inbox in hybrid environments
• Availability (free/busy) fails for delegated mailboxes in Exchange hybrid deployments using Graph API only

Known Issues

Be aware of the following known issue after installing the SU:

• Published calendar (.ics) returns HTTP 500 for calendar applications | Microsoft Support

Notes

• Security updates are specific to the Cumulative Update level. You cannot apply the Exchange 2019 CU15 security update to Exchange 2019 CU14. When downloading, the security update might carry the same name for different Cumulative Updates. Microsoft now includes the KB article number as a reference, but I still tag the filename with the CU level for archival purposes, e.g., Exchange2019-CU15-KBxxxxxxx-x64-en.exe.
• Like Cumulative Updates, Security Updates are cumulative, and you only need to install the latest SU for your CU.
• Suppose you have deployed Exchange Management Tools to manage your on-premises Exchange Servers or installed the tools after removing the Last Exchange Server for recipient management. We recommend applying the Security Update.

Finally, as with any patch or update, test it in a test environment before deploying it to production. However, we do not recommend waiting for regular maintenance cycles for security updates; a more agile approach is preferable, and the ratings indicate the urgency level.