The Exchange product group released the November 2026 update for Exchange Server SE. As mentioned in the previous Security Updates post, the October security updates were the last updates for earlier Exchange Server versions.

The vulnerabilities addressed in this Security Update are:

Vulnerability	Category	Severity	Rating
CVE-2026-118149	Remote Code Execution	Important	CVSS:3.1 8.8 / 7.7
CVE-2026-118150	Elevation of Privilege	Important	CVSS:3.1 8.8 / 7.7
CVE-2026-118151	Elevation of Privilege	Important	CVSS:3.1 7.2 / 6.3
CVE-2026-118152	Spoofing	Important	CVSS:3.1 6.5 / 5.7
CVE-2026-118153	Denial of Service	Important	CVSS:3.1 7.5 / 6.5
CVE-2026-118154	Elevation of Privilege	Important	CVSS:3.1 8.8 / 7.7
CVE-2026-118157	Elevation of Privilege	Important	CVSS:3.1 7.2 / 6.3
CVE-2026-118207	Remote Code Execution	Critical	CVSS:3.1 8.8 / 7.7
CVE-2026-118208	Spoofing	Important	CVSS:3.1 7.1 / 6.2

The Security Update is linked below:

Exchange	HU/Su	Download	Build	KB	Supersedes
Exchange SE	12	Download	15.2.2562.57	KB5133453	KB5128895

Issues resolved

• The issue with the RPC endpoint mapper, which appeared after installing the October updates for Windows Server, is addressed in the November updates for Windows Server. If you created the registry key to raise the new default RPC limit, you can remove this registry key after installing the November updates for Windows Server.
• Microsoft Graph displays incorrect free/busy availability information in Microsoft Exchange server SE hybrid setup

Notes

• Security Updates are cumulative, and you only need to install the latest SU for your CU.
• If you deployed Exchange Management Tools to manage your on-premises Exchange Servers, or installed the tools after removing the Last Exchange Server for recipient management, we recommend applying the Security Update.

Finally, as with any patch or update, test it in a test environment before deploying it to production. However, we do not recommend waiting for regular maintenance cycles for security updates; a more agile approach is preferable, and the ratings indicate the urgency level.