The Exchange product group released the October 2026 updates for Exchange Server SE, Exchange 2019, and Exchange 2016. The Security Update for Exchange SE is publicly available. Security updates for Exchange 2019 and Exchange 2016 are available to organizations enrolled in the Extended Security Update Period 2 program.

Note: These are the final Security Updates for Exchange 2016 and Exchange 2019. As of now, Microsoft will not test Exchange 2019 or Exchange 2016 for new CVEs, and they will not receive any further SUs. The ESU2 program will be available for a while, but it will only bring you up to the October 2026 SU level.

The vulnerabilities addressed in these Security Updates are:

Vulnerability	Category	Severity	Rating
CVE-2026-70571	Remote Code Execution	Critical	CVSS:3.1 8.1 / 7.1
CVE-2026-77910	Elevation of Privilege	Important	CVSS:3.1 8.8 / 7.7
CVE-2026-87692	Elevation of Privilege	Important	CVSS:3.1 7.8 / 6.8
CVE-2026-87695	Elevation of Privilege	Important	CVSS:3.1 7.8 / 6.8
CVE-2026-87696	Elevation of Privilege	Important	CVSS:3.1 7.5 / 6.5
CVE-2026-70279	Spoofing Vulnerability	Important	CVSS:3.1 9.3 / 8.1

The Security Updates for each supported Exchange Server build are linked below:

Exchange	HU/Su	Download	Build	KB	Supersedes
Exchange SE	11	Download	15.2.2562.56	KB5128895	KB5129955
Exchange 2019 CU15	12	ESU2	15.2.1748.55	KB5128896	KB5129956
Exchange 2019 CU14	15	ESU2	15.2.1544.50	KB5128897	KB5129957
Exchange 2016 CU23	26	ESU2	15.1.2507.77	KB5128898	KB5129958

Issues resolved

• Published calendar (.ics) returns HTTP 500 for calendar applications
• ContentEngine deadlock because of missing Korean WordBreaker rule files

Notes

• Security updates are specific to the Cumulative Update level. You cannot apply the Exchange 2019 CU15 security update to Exchange 2019 CU14. When downloading, the security update may have the same name across different Cumulative Updates. Microsoft now includes the KB article number as a reference, but I still tag the filename with the CU level for archival purposes, e.g., Exchange2019-CU15-KBxxxxxxx-x64-en.exe.
• Like Cumulative Updates, Security Updates are cumulative, and you only need to install the latest SU for your CU.
• If you deployed Exchange Management Tools to manage your on-premises Exchange Servers, or installed the tools after removing the Last Exchange Server for recipient management, we recommend applying the Security Update.

Finally, as with any patch or update, test it in a test environment before deploying it to production. However, we do not recommend waiting for regular maintenance cycles for security updates; a more agile approach is preferable, and the ratings indicate the urgency level.