Security Updates Exchange 2013-2019 (Oct2021)

Welcome to another Patch Tuesday! A quick blog on October’s security updates for Exchange Server 2013 up to 2019.

The vulnerabilities addressed in these security updates are:

VulnerabilityCategorySeverityRating
CVE-2021-26427Remote Code ExecutionImportantCVSS:3.0 9.0 / 7.8
CVE-2021-41350SpoofingImportantCVSS:3.0 6.5 / 5.7
CVE-2021-41348Elevation of PrivilegeImportantCVSS:3.0 8.0 / 7.0
CVE-2021-34453Denial of ServiceImportantCVSS:3.0 7.5 / 6.5

Vulnerabilities mentioned in the table above are addressed in the following security updates. Exception is Exchange 2013 CU23 which seemingly only gets fixed for CVE-2021-26427; it is unclear if that is because of Exchange 2013’s lifecycle phase or because the problem does not exist in those builds.

ExchangeDownloadBuildKBSupersedes
Exchange 2019 CU11Download15.2.986.9KB5007012
Exchange 2019 CU10Download15.2.922.14KB5007012
Exchange 2016 CU22Download15.1.2375.12KB5007012
Exchange 2016 CU21Download15.1.2308.15KB5007012
Exchange 2013 CU23Download15.0.1497.24KB5007011

More detailed information can be found at the original blog post here. Check the KB articles for any known release notes, such as the possible cross-forest Free/Busy issue and HTTP headers containing version information.

Be advised that these security updates are Cumulative Update level specific. You cannot apply the update for Exchange 2019 CU11 to Exchange 2019 CU10. Also, the security update download has the same name for different Cumulative Updates, and I would suggest tagging the file name with the CU level, e.g. Exchange2019-CU10-KBXXXXXX-x64-en.msp.

As a reminder, run the Security Update from an elevated command prompt to prevent issues during installation. In other words: Do not just double-click on the .MSP file. And on a final note, as with any patch or update, I’d recommend to apply this in a test environment first, prior to implementing it in production. However, it is not recommended to wait for regular maintenance cycles when it concerns security updates, and follow a more agile approach; the ratings are an indication of the urgency.

Security Updates Exchange 2013-2019 (Jul2021)

Update July 20th: Added VC++2012 requirement to tip on running MT to prepare Exchange 2013 schema separately.

Another month, another Patch Tuesday! A quick blog on the July’s security updates for Exchange Server 2013 up to 2019.

The vulnerabilities addressed in these security updates are:

VulnerabilityCategorySeverityRating
CVE-2021-31196Remote Code Execution ImportantCVSS:3.0 7.2 / 6.3
CVE-2021-34470Elevation of PrivilegeImportantCVSS:3.0 8.0 / 7.0
CVE-2021-33768Elevation of PrivilegeImportantCVSS:3.0 8.0 / 7.0
CVE-2021-31206Remote Code ExecutionImportantCVSS:3.0 7.6 / 7.1

Note:

  • When looking at the MSRC information, you will notice 3 additional CVE issues addressed for July 13th. However, as far as I can see CVE-2021-34473, CVE-2021-34523 and CVE-2021-33766 were addressed in the April 2021 and eventually the May 2021 Security Updates, which also would explain MSRC’s mention of earlier CUs, such as Exchange 2019 CU8.
  • CVE-2021-31206 was the vulnerability discovered at the Pwn2Own 2021 contest.

Vulnerabilities mentioned in the table above are addressed in the following security updates:

ExchangeDownloadBuildKBSupersedes
Exchange 2019 CU10Download15.2.922.13KB5004780
Exchange 2019 CU9Download15.2.858.15KB5004780
Exchange 2016 CU21Download15.1.2308.14KB5004779
Exchange 2016 CU20Download15.1.2242.12KB5004779
Exchange 2013 CU23Download15.0.1497.23KB5004778

Notes:

  • CVE-2021-33768 does not seem applicable to Exchange 2019 CU9 or Exchange 2016 CU20.
  • CVE-2021-34470 is only addressed in the security update for Exchange 2013 CU23.

More detailed information can be found at the original blog post here, which mentions some specific post-deployment instructions:

  • When running n-1 CU of Exchange 2019 (CU9) or Exchange 2016 (CU20), and you do not plan to upgrade to the latest CU yet but do wish to install this Security Update, you must also update the AD Schema using the CU10 or CU21 installation files.
  • When you are running Exchange 2013 CU23 in your organization, and no later Exchange builds are present, you need to deploy a schema update immediately after deploying the Security Update. After deploying the SU, from an elevated CMD prompt, run Setup.exe /PrepareSchema /IAcceptExchangeServerLicenseTerms from Exchange’s bin folder. You you need to separate the update from deploying the update, see end of article for a tip.

The blog also mentions some issues, which are identical to the ones mentioned with the May 2021 Security Updates:

  • Accounts ending in ‘$’ cannot use EMS or access the ECP.
  • Cross-forest Free/Busy might stop working resulting in 400 Bad Request (solution).
  • Running cmdlets against EMC using invoked runspace might result in no-language mode error (info).

Be advised that these security updates are Cumulative Update level specific. You cannot apply the update for Exchange 2019 CU9 to Exchange 2019 CU8. Also, the security update download has the same name for different Cumulative Updates, and I would suggest tagging the file name with the CU level, e.g. Exchange2019-CU9-KBXXXXXX-x64-en.msp.

On another note, after deploying the security updates Exchange will start reporting its version number in the HTTP response header.

As a reminder, run the Security Update from an elevated command prompt to prevent issues during installation. In other words: Do not just double-click on the .MSP file. And on a final note, as with any patch or update, I’d recommend to apply this in a acceptance environment first, prior to implementing it in production. However, it is not recommended to wait for regular maintenance cycles when it concerns security updates, and follow a more agile approach. The rating implies a form of urgency.

OWA/ECP and HMAC errors
There are reports of the Security Update breaking OWA/ECP. Symptoms are browsers displaying an HMAC error:

Server Error in '/owa' Application.

ASSERT: HMACProvider.GetCertificates:protectionCertificates.Length<1
Description: An unhandled exception occurred during the execution of the current web request. Please review the stack trace for more information about the error and where it originated in the code.
    
Exception Details: Microsoft.Exchange.Diagnostics.ExAssertException: ASSERT: HMACProvider.GetCertificates:protectionCertificates.Length<1

It is likely related to “Microsoft Exchange Server Auth Certificate”, which can be expired, invalid or for other reasons not being picked up. The reported solution is renewing the “Microsoft Exchange Server Auth Certificate”. This procedure can be found here. Do note that it may take an hour for the certificate to become effective. Meanwhile, you can check the comments in the original Exchange Team post, which is lively with feedback and responses.

Exchange 2013 CU23 SU & Schema Updating
Because with Exchange 2013 CU23 schema preparation needs to occur immediately after deploying the SU on (the first) Exchange 2013 CU23 server, a tip might be that you could deploy Exchange 2013 CU23 Management Tools on a workstation, install the SU on that workstation, then run the PrepareSchema from there before deploying the SU on any Exchange 2013 CU23 server.

This might also be helpful in multi-domain organizations, or organizations where AD and Exchange are managed by different teams or require separate changes. Note that performing the schema update this way requires Visual C++ 2012 Runtime, otherwise you will run into a “Exchange Server setup didn’t complete the operation” and the ExchangeSetup.log will contain “Could not load file or assembly ‘Microsoft.Exchange.CabUtility.dll”.

Security Updates Exchange 2010-2019 (Dec2020)

A quick blog on security updates for Exchange Server 2013, 2016 and 2019 released December 8th. These fixes address the following vulnerability:

Exchange 2016 / 2019

  • CVE-2020-17117: Microsoft Exchange Remote Code Execution Vulnerability
  • CVE-2020-17132: Microsoft Exchange Remote Code Execution Vulnerability
  • CVE-2020-17141: Microsoft Exchange Remote Code Execution Vulnerability
  • CVE-2020-17142: Microsoft Exchange Remote Code Execution Vulnerability
  • CVE-2020-17143: Microsoft Exchange Information Disclosure Vulnerability

Exchange 2013

  • CVE-2020-17117: Microsoft Exchange Remote Code Execution Vulnerability
  • CVE-2020-17132: Microsoft Exchange Remote Code Execution Vulnerability
  • CVE-2020-17142: Microsoft Exchange Remote Code Execution Vulnerability
  • CVE-2020-17143: Microsoft Exchange Information Disclosure Vulnerability

Exchange 2010

  • CVE-2020-17144: Microsoft Exchange Remote Code Execution Vulnerability

The exploits can be fixed by single security update, which you can find in the table below per current Exchange version.

ExchangeDownloadBuildKBSupersedes
Exchange 2019 CU7Download15.2.721.6KB4593465KB4588741
Exchange 2019 CU6Download15.2.659.11KB4593465KB4588741
Exchange 2016 CU18Download15.1.2106.6KB4593465KB4588741
Exchange 2016 CU17Download15.1.2044.12KB4593465KB4588741
Exchange 2013 CU23Download15.0.1497.10KB4593466
Exchange 2010 SP3 RU31 Download14.3.509.0KB4593467

Be advised that these security updates are Cumulative Update level specific. You cannot apply the update for Exchange 2016 CU17 to Exchange 2016 CU16. Also, the security update download has the same name for different Cumulative Updates, and I would suggest tagging the file name with the CU level, e.g. Exchange2019-CU6-KB4588741-x64-en.msp.

Also, run the Security Update from an elevated command prompt, to prevent issues during installation. And on a final note, as with any patch or update, I’d recommend to apply this in a acceptance environment first, prior to implementing it in production.

Security Updates Exchange 2013-2019 (Nov2020)

A quick blog on security updates for Exchange Server 2013, 2016 and 2019 released November 10th. These fixes address the following vulnerability:

  • CVE-2020-17085: Microsoft Exchange Server Denial of Service Vulnerability
  • CVE-2020-17084: Microsoft Exchange Server Remote Code Execution Vulnerability
  • CVE-2020-17083: Microsoft Exchange Server Remote Code Execution Vulnerability

The exploits can be fixed by single security update, which you can find in the table below per current Exchange version.

ExchangeDownloadBuildKBSupersedes
Exchange 2019 CU7Download15.2.721.4KB4588741KB4581424
Exchange 2019 CU6Download15.2.659.8KB4588741KB4581424
Exchange 2016 CU18Download15.1.2106.4KB4588741KB4581424
Exchange 2016 CU17Download15.1.2044.8KB4588741KB4581424
Exchange 2013 CU23Download15.0.1497.8KB4588741KB4581424

Be advised that these security updates are Cumulative Update level specific. You cannot apply the update for Exchange 2016 CU17 to Exchange 2016 CU16. Also, the security update download has the same name for different Cumulative Updates, and I would suggest tagging the file name with the CU level, e.g. Exchange2019-CU6-KB4588741-x64-en.msp.

Also, run the Security Update from an elevated command prompt, to prevent issues during installation. And on a final note, as with any patch or update, I’d recommend to apply this in a acceptance environment first, prior to implementing it in production.

Security Updates Exchange 2013-2019 (Oct2020)

A quick blog on security updates for Exchange Server 2013, 2016 and 2019 released October 13th. These fixes address the following vulnerability:

  • CVE-2020-16969: Microsoft Exchange Information Disclosure Vulnerability
    An information disclosure vulnerability exists in how Microsoft Exchange validates tokens when handling certain messages. An attacker who successfully exploited the vulnerability could use this to gain further information from a user.

    To exploit the vulnerability, an attacker could include specially crafted OWA messages that could be loaded, without warning or filtering, from the attacker-controlled URL. This callback vector provides an information disclosure tactic used in web beacons and other types of tracking systems.

    The security update corrects the way that Exchange handles these token validations.

The exploits can be fixed by single security update, which you can find in the table below per current Exchange version.

ExchangeDownloadBuildKBSupersedes
Exchange 2019 CU7Download15.2.721.3KB4581424KB4577352
Exchange 2019 CU6Download15.2.659.7KB4581424KB4577352
Exchange 2016 CU18Download15.1.2106.3KB4581424KB4577352
Exchange 2016 CU17Download15.1.2044.7KB4581424KB4577352
Exchange 2013 CU23Download15.0.1497.7KB4581424KB4536988

Be advised that these security updates are Cumulative Update level specific. You cannot apply the update for Exchange 2016 CU17 to Exchange 2016 CU16. Also, the security update download has the same name for different Cumulative Updates, and I would suggest tagging the file name with the CU level, e.g. Exchange2016-CU17-KB4581424-x64-en.msp.

Also, run the Security Update from an elevated command prompt, to prevent issues during installation. And on a final note, as with any patch or update, I’d recommend to apply this in a acceptance environment first, prior to implementing it in production.

Security Updates Exchange 2013, 2016 & 2019

Ex2013 LogoUpdate 14jan: Added Exchange 2010 SP3 RU25

A quick heads-up as during my vacation Microsoft released security updates for supported releases of Exchange Server 2013, 2016 as well as Exchange Server 2019. In addition, a new Rollup was released for Exchange 2010 as well, containing one of the security updates.

The security updates patch issues as reported in the following Microsoft Common Vulnerabilities and Exposures:

  • CVE-2019-0586: Microsoft Exchange Memory Corruption Vulnerability
  • CVE-2019-0588: Microsoft Exchange Information Disclosure Vulnerability

You can download the security updates here:

Notes:

  • Exchange 2010 SP3 RU25 addresses CVE-2019-0588 only.
  • KB4471389 supersedes KB4468741 and KB4459266; KB4468742 supersedes KB4458321.

Be advised that the Security Updates for Exchange 2013 and 2016 are Cumulative Update level specific. Unfortunately, the security update carries the same name for different CU’s, and you cannot apply the update for Exchange 2016 CU10 to Exchange 2016 CU11. I would suggest tagging the Cumulative Update in the file name when you archive it, e.g. Exchange2016-KB4471389-x64-en-CU10.msp.

As with any patch or update, I’d recommend to thoroughly test this in a test and acceptance environment first, prior to implementing it in production.

Exchange Updates – June 2018

Ex2013 LogoThe Exchange Team released the June updates for Exchange Server 2013 and 2016, and an additional Rollup 22 for Exchange Server 2010 Service Pack 3.

Apart from fixes and time zone changes, these updates contain the following important changes and notes:

  • As announced earlier, Exchange 2013 CU21 and Exchange 2016 CU10 require .NET Framework 4.7.1.
  • All three updates require the VC++ 2013 runtime library, because it is needed by a 3rd component in WebReady Document Viewing in Exchange 2010/2013 and Data Loss Prevention in Exchange 2013/2016. Exchange 2010 SP3 RU22 will force installation of this VC++ runtime.
  • Updates include a critical security patch for Oracle Outside In libraries. More about the issue in MSRC advisory ADV180010.
  • Exchange 2013 CU21 and Exchange 2016 CU10 introduce support for directly creating and enabling remote shared mailboxes, e.g.
    New-RemoteMailbox [-Shared] [-Name remoteMailboxName]
    Enable-RemoteMailbox [-Identity user] [-Shared] [-RemoteRoutingAddress user@domain]
    Set-RemoteMailbox [-Name user] [-Type Shared]

    You need to run setup /PrepareAD to see these changes. More information in KB4133605.

  • This is the last planned Cumulative Update for Exchange 2013 as it enters Extended Support.
  • Exchange 2010 SP3 RU22 adds support for Windows Server 2016 Domain Controllers.

 

Version Build KB Article Download UMLP Schema Changes
Exchange 2016 CU10 15.1.1531.3 KB4099852 Download UMLP No
Exchange 2013 CU21 15.0.1395.4 KB4099855 Download UMLP No
Exchange 2010 SP3 RU22 14.3.411.0 KB4295699 Download

Exchange 2016 CU10 fixes:

  • 4056609 Event ID 4999 and mailbox transport delivery service won’t start with Exchange Server 2016 CU7 installed
  • 4133605 Cmdlets to create or modify a remote shared mailbox in an on-premises Exchange environment
  • 4133620 “HTTP 500 due to ADReferralException” error when a user tries to view detail properties of mailboxes in a child domain in Exchange Server
  • 4095974 “System.InvalidOperationException” occurs when the “Enable-MailPublicFolder” cmdlet is run against a public folder in Exchange Server
  • 4095973 Set-ServerComponentState cmdlet does not honor the write scope defined in the RBAC management scope in Exchange Server
  • 4095993 HTTP 500 error when an administrator tries to manage regional settings in ECP on Windows Server 2016
  • 4294209 Cannot clear the “Maximum message size” check box for Send messages or Receive messages in EAC in Exchange Server 2016
  • 4294208 “TooManyObjectsOpenedException” error when you run the “Get-PublicFolderMailboxDiagnostics” cmdlet in Exchange Server
  • 4294212 Cannot send VBScript-created messages in the Outlook 2016 client
  • 4294211 Cannot run “Set-CalendarProcessing” cmdlets after you apply CU8 or CU9 for Exchange Server 2016
  • 4294210 Cannot edit an email attachment in OWA in an Exchange Server 2016 environment
  • 4294204 Changing “IsOutOfService” to “False” in an earlier Exchange Server version does not immediately update in a later Exchange Server environment
  • 4092041 Description of the security update for Microsoft Exchange Server 2013 and 2016: May 8, 2018

Exchange 2013 CU20 fixes:

  • 4133605 Cmdlets to create or modify a remote shared mailbox in an on-premises Exchange environment
  • 4133604 User can’t log on to a POP/IMAP account by using NTLM authentication in Exchange Server 2013
  • 4133618 Unexpected error occurs when running the Get-DatabaseAvailabilityGroupNetwork cmdlet in Exchange Server 2013
  • 4133620 “HTTP 500 due to ADReferralException” when a user tries to view detail properties of mailboxes in a child domain in Exchange Server
  • 4058473 An Office 365 primary mailbox user cannot be assigned full access permissions for an on-premises mailbox in Exchange Server
  • 4094167 The MSExchangeRPC service crashes with a System.NullReferenceException exception in Exchange Server 2013
  • 4095974 “System.InvalidOperationException” occurs when the “Enable-MailPublicFolder” cmdlet is run against a public folder in Exchange Server
  • 4092041 Description of the security update for Microsoft Exchange Server 2013 and 2016: May 8, 2018
  • 4294205 POP3 services intermittently stop in an Exchange Server 2013 environment
  • 4294204 Changing “IsOutOfService” to “False” in an earlier Exchange Server version does not immediately update in a later Exchange Server environment

Exchange 2010 Rollup 22 fixes:

  • 4295751 EWS impersonation not working when accessing resource mailboxes in a different site in Exchange Server 2010 SP3

Notes:

  • Exchange 2016 CU8 and Exchange 2013 CU18 do not contain schema changes compared to their previous Cumulative Update. However, they introduce RBAC changes in your environment. Use setup /PrepareAD to apply RBAC changes, before deploying or updating Exchange servers.
  • When upgrading from an n-2 or earlier version of Exchange, or an early version of the .NET Framework, consult Upgrade Paths for CU’s & .NET.
  • When upgrading your Exchange 2013 or 2016 installation, don’t forget to put the server in maintenance mode when required. Regardless, setup will put the server in server-wide offline mode post-analysis, before making actual changes.
  • When using Exchange hybrid deployments or Exchange Online Archiving (EOA), you are required to stay at most one version behind (n-1).
  • If you want to speed up the update process for systems without internet access, you can follow the procedure described here to disable publisher’s certificate revocation checking.
  • Cumulative Updates can be installed directly, i.e. no need to install RTM prior to installing Cumulative Updates.
  • Once installed, you can’t uninstall a Cumulative Update nor any of the installed Exchange server roles.
  • The order in which you upgrade servers with Cumulative Updates is irrelevant.

Caution:

As for any update, I recommend to thoroughly test updates in a test environment prior to implementing them in production. When you lack such facilities, hold out a few days and monitor the comments on the original publication or forums for any issues.

Exchange Updates – March 2018

Ex2013 LogoThe Exchange Team released the March updates for Exchange Server 2013 and 2016, and these Cumulative Updates contain a ton of fixes. Like the earlier Cumulative Updates for Exchange 2013 and Exchange 2016, and in addition to the fixes – see below – these Cumulative Updates contain the following important changes:

  • Support for .NET Framework 4.7.1. Be advised that .NET Framework 4.7.1 will be required for the next cycle of quarterly updates, which will be released in June 2018.
  • Full support for TLS 1.2. More information and guidance here.

On a smaller note, Exchange 2010 Service Pack 3 Rollup 20 was also released, which contains two security fixes CVE-2018-0924 and CVE-2018-0940, as well as DST changes.

Version Build KB Article Download UMLP Schema Changes
Exchange 2016 CU9 15.1.1466.3 KB4055222 Download UMLP No
Exchange 2013 CU20 15.0.1367.3 KB4055221 Download UMLP No
Exchange 2010 SP3 RU20 14.3.389.1 KB4073537 Download

Exchange 2016 CU9 fixes:

  • 4054513 Mailbox usage status bar in OWA displays incorrect mailbox usage
  • 4055433 User is added to an entire series when accepting a single instance through Exchange ActiveSync
  • 4057216 Health mailbox’s password is exposed in logs for a failed probe in Exchange Server 2016 and 2013
  • 4058373 “A parameter cannot be found” error when you run Install-AntiSpamAgents.ps1 in Exchange Server 2016 CU7
  • 4058379 All cross-forest meeting updates have to be accepted again in Exchange Server 2016 and 2013
  • 4058383 Exchange Control Panel (ECP) redirection fails in Exchange Server 2016
  • 4058384 Get-CalendarDiagnosticAnalysis shows DateTime in 12-hour clock in Exchange Server 2016 and 2013
  • 4058399 Disabling a mailbox can’t remove legacyExchangeDN from user’s properties in Exchange Server 2016
  • 4073094 Emails outside a UID range are returned when you request for emails by using IMAP
  • 4073095 “550 5.6.0 CAT.InvalidContent.Exception” and email isn’t delivered in Exchange Server 2016 and 2013
  • 4073104 PIN can be reset on a Unified Messaging (UM)-enabled mailbox for a user outside a scoped OU
  • 4073103 The Enable-Mailbox cmdlet doesn’t block migrated users from provisioning in Exchange Server 2016
  • 4073107 Language can’t be changed when a user from a child domain tries to change language in OWA
  • 4073111 Can’t access a CAS website such as OWA/ECP/Autodiscover in Exchange Server 2016
  • 4073110 You can’t access OWA or ECP after you install Exchange Server 2016 CU8
  • 4073109 Search-MailboxAuditLog -ShowDetails not showing all messages in Exchange Server 2016
  • 4073114 “ADOperationException” error when OWA text verification fails in Exchange Server 2016
  • 4073214 Can’t enable OWA offline access in Exchange Server 2016
  • 4073531 CultureNotFoundException when selecting a LCID 4096 language in OWA for Exchange Server 2016
  • 4076520 MatchSubdomains isn’t usable for Set-AcceptedDomain in Exchange Server 2016
  • 4076741 Incorrect NDR when an administrator deletes a message from a queue in Exchange Server 2016
  • 4077655 Event ID 258 “Unable to determine the installed file” after you uninstall Windows PowerShell 2.0
  • 4057290 Incorrect user is returned in the ECP when one user’s display name matches another user’s alias
  • 4058372 Blank page in Exchange Admin Center Audit Log in Exchange Server 2016
  • 4058382 Can’t retrieve time slot information about private calendar items as a delegate on another user’s account in Exchange Server 2016
  • 4058401 Administrator audit logging does not record Set-ServerComponentState cmdlet details in Exchange Server 2013 or 2016 environment
  • 4073097 Monitoring probes of ECP.Proxy health checks fail on all CAS roles in Exchange Server 2013 and 2016
  • 4073098 The ETS and EXS groups are incorrectly granted “SeDebugPrivilege” in Exchange Server 2016 on-premises
  • 4073108 “There was a problem loading your options” error when a user accesses OWA Voice Mail options in Exchange Server 2016
  • 4077924 Store Worker process crashes when you move, restore, or repair mailboxes that have issues with the logical index within the database in Exchange Server 2016
  • 4091453 Update improves linguistics features and CJK handling for search in Exchange Server 2016
  • 4073392 Description of the security update for Microsoft Exchange: March 13, 2018

Exchange 2013 CU20 fixes:

  • 4073392 Description of the security update for Microsoft Exchange: March 13, 2018
  • 4073094 Emails outside a UID range are returned when you request for emails by using IMAP
  • 4073097 Monitoring probes of ECP.Proxy health checks fail on all CAS roles in Exchange Server 2013 and 2016
  • 4057216 Health mailbox’s password is exposed in logs for a failed probe in Exchange Server 2016 and 2013
  • 4058384 Get-CalendarDiagnosticAnalysis shows DateTime in 12-hour clock in Exchange Server 2016 and 2013
  • 4057290 Incorrect user is returned in the ECP when one user’s display name matches another user’s alias
  • 4055433 User is added to an entire series when accepting a single instance through Exchange ActiveSync
  • 4058401 Administrator audit logging does not record Set-ServerComponentState cmdlet details in Exchange Server 2013 or 2016 environment
  • 4073095 “550 5.6.0 CAT.InvalidContent.Exception” and email isn’t delivered in Exchange Server 2016 and 2013
  • 4058379 All cross-forest meeting updates have to be accepted again in Exchange Server 2016 and 2013
  • 4073093 Save issues occur when you use the plain Text Editor in OWA of Exchange Server 2013
  • 4073096 Emails sent from a shared mailbox aren’t saved in Sent Items when MessageCopyForSentAsEnabled is True

Notes:

  • Exchange 2016 CU7 and later requires Forest Functionality Level 2008R2 or later.
  • Exchange 2016 CU8 and Exchange 2013 CU18 do not contain schema changes compared to their previous Cumulative Update. However, they may introduce RBAC changes in your environment. Use setup /PrepareSchema to manually update the schema, or use /PrepareAD to apply RBAC changes, before deploying or updating Exchange servers. To see if you need to update the schema compared to your version or verify the update has been performed, consult the Exchange schema overview.
  • When upgrading from an n-2 or earlier version of Exchange, or an early version of the .NET Framework, consult Upgrade Paths for CU’s & .NET.
  • When upgrading your Exchange 2013 or 2016 installation, don’t forget to put the server in maintenance mode when required. Regardless, setup will put the server in server-wide offline mode post-analysis, before making actual changes.
  • Using Windows Management Framework (WMF)/PowerShell version 5 or later on anything earlier than Windows Server 2016 is not supported. Don’t install WMF5 on your Exchange servers running on Windows Server 2012 R2 or earlier.
  • When using Exchange hybrid deployments or Exchange Online Archiving (EOA), you are required to stay at most one version behind (n-1).
  • If you want to speed up the update process for systems without internet access, you can follow the procedure described here to disable publisher’s certificate revocation checking.
  • Cumulative Updates can be installed directly, i.e. no need to install RTM prior to installing Cumulative Updates.
  • Once installed, you can’t uninstall a Cumulative Update nor any of the installed Exchange server roles.
  • The order in which you upgrade servers with Cumulative Updates is irrelevant.

Caution:

As for any update, I recommend to thoroughly test updates in a test environment prior to implementing them in production. When you lack such facilities, hold out a few days and monitor the comments on the original publication or forums for any issues.

 

Upgrade Paths for CU’s & .NET

9/28/21: Updated for September CU updates.

Microsoft keeps track of the current supported combinations of .NET Framework and Exchange Cumulative Updates at the Exchange Server Supportability Matrix. However, as time progresses, support information on older Cumulative Updates might be removed from the information presented, and you may need to resort to cached versions of this page or other sources to find this information.

This might be problematic for organizations that are not current, and need to find out which upgrade path they are required to follow to stay within the boundaries of supported Exchange deployment configurations. For example, you may need to upgrade to a specific Cumulative Update first, that is supported with a newer release of the .NET Framework, in order to be able to upgrade to a later Cumulative Update.

For these situations, the following tables contains the supportability matrix, enhanced with information regarding earlier Cumulative Updates and .NET Framework versions. These will provide you the supported upgrade paths for older versions of Exchange.

Exchange 2019

.NETRTM-CU1CU2-CU3CU4-CU11
4.7.2XX
4.8XX

Exchange 2016

.NETRTM-
CU1
CU2CU3-
CU4
CU5-
CU7
CU8CU9CU10CU11-
CU12
CU13-
CU14
CU15-
CU22
4.5
4.5.1
4.5.2XXX
4.6.11XX
4.6.2XXXX
4.72
4.7.1XXXX
4.7.2XX
4.8XX

Exchange 2013

.NETRTM-
CU3
CU4(SP1)-
CU12
CU13-
CU14
CU15CU16-
CU18
CU19CU20CU21-
CU22
CU23
4.5XXX
4.5.1XXX
4.5.2XXX
4.6.11XX
4.6.2XXXX
4.72
4.7.1XXX
4.7.2XX
4.8X

Notes

  1. When possible, bypass .NET Framework 4.6.1, as it not only requires updating the CU level prior to updating the .NET Framework, but also requires an additional hotfix: kb3146715 (ws2012r2), kb3146714 (ws2012) or kb3146716 (ws2008r2).
  2. .NET Framework 4.7 is not supported for any product level.

Usage
Suppose your organization loves procrastinating, and you are running Exchange 2013 CU6. Luckily, you run it on .NET Framework 4.5.1, which was already a supported configuration back in 2014 – yes, it’s been that long. Looking at the table, to get current with a minimal number of updates in mind, you can derive the following path:

The upgrade path to CU19 would therefor be:

  1. Upgrade to Exchange 2013 Cumulative Update 15
  2. Upgrade .NET Framework to 4.6.2
  3. Upgrade to Exchange 2013 Cumulative Update 19
  4. Upgrade .NET Framework to 4.7.1 (Optional)

Note that in addition to information being refreshed on Microsoft pages, availability of older Cumulative Updates or .NET Framework updates might also change, so archive those files accordingly, if not for recovery of existing Exchange servers, then for this exact purpose.

Of course, you should stay current as possible from a support and security perspective, making the above a non-issue. Reality is, there are customers who have reasons, legitimate or not, to be trailing with updates in their environment, and at some point may need guidance on how to proceed in order to get current. I hope this information helps in those situations.

Thoughts and feedback is welcomed in the comments.

Update: Per February 13th, Microsoft updated upgrade guidance on the Exchange Supportability Matrix page, stating:

“When upgrading Exchange from an unsupported CU to the current CU and no intermediate CUs are available, you should upgrade to the latest version of .NET that’s supported by Exchange first and then immediately upgrade to the current CU. This method doesn’t replace the need to keep your Exchange servers up to date and on the latest, supported, CU. Microsoft makes no claim that an upgrade failure will not occur using this method, which may result in the need to contact Microsoft Support Services”.

This means you will be supported when upgrading in the revised upgrade path, but the risk is still there. In the example above, when going from Exchange 2013 CU6 with .NET 4.5.1 to CU19, the support statement indicates you can upgrade to .NET Framework 4.7.1, when install CU19. However, things might break and you may need to contact support to get back in a supported, working situation. Therefor, I repeat my recommendation to download and archive CU’s and .NET Framework files, even when you are not planning on installing them (yet).

Exchange Updates – December 2017

Ex2013 LogoThe Exchange Team released the December updates for Exchange Server 2013 and 2016. Apart from the usual set of fixes, these Cumulative Updates also have the following enhancements:

  • Like announced earlier, these quartely updates introduce support for .NET Framework 4.7.1. Be advised that .NET Framework 4.7.1 will be required for the quarterly updates to be released in June 2018.
  • Upgrading an existing Exchange deployment with these Cumulative Updates will preserve TLS cryptography settings.
  • Support for Hybrid Modern Authentication (Info).
Version Build KB Article Download UMLP Schema Changes
Exchange 2016 CU8 15.1.1415.2 KB4035145 Download UMLP Yes
Exchange 2013 CU19 15.0.1365.1 KB4037224 Download UMLP No

Exchange 2016 CU8 fixes:

  • 4056329 Can’t access EWS from Outlook/OWA add-ins via makeEwsRequestAsync in Exchange Server 2016 and Exchange Server 2013
  • 4054516 “Your request can’t” error when accessing an archive mailbox via OWA in Exchange Server 2016
  • 4055953 The recipient scope setting doesn’t work for sibling domains in Exchange Server 2016
  • 4055435 No MAPI network interface is found after you install Exchange Server 2016 CU7
  • 4056609 Event ID 4999 and mailbox transport delivery service does not start after you install Exchange Server 2016 CU7
  • 4045655 Description of the security update for Microsoft Exchange: December 12, 2017
  • 4057248 Many Watson reports for StoragePermanentException in Exchange Server 2016

Exchange 2013 CU19 fixes:

  • 4046316 MAPI over HTTP can’t remove client sessions timely if using OAuth and the resource has a master account in Exchange Server 2013
  • 4046205 W3wp high CPU usage in Exchange Server 2013
  • 4046182 Event ID 4999 or 1007 if diagnostics service crashes repeatedly in Exchange Server 2013
  • 4056329 Can’t access EWS from Outlook/OWA add-ins via makeEwsRequestAsync in Exchange Server 2016 and Exchange Server 2013
  • 4045655 Description of the security update for Microsoft Exchange: December 12, 2017

Exchange 2010
In addition the Cumulative Updates, Exchange Server 2010 SP3 also received an important update, which fixes the issue described in KB4054456. You can download Rollup 19 here, which will raise the version number to 14.3.382.0. The related KB article is KB4035162.

Notes:
  • Exchange 2016 CU7 and later requires Forest Functionality Level 2008R2 or later.
  • Exchange 2016 CU8 and Exchange 2013 CU18 do not contain schema changes compared to their previous Cumulative Update. However, they may introduce RBAC changes in your environment. Use setup /PrepareSchema to manually update the schema, or use /PrepareAD to apply RBAC changes, before deploying or updating Exchange servers. To see if you need to update the schema compared to your version or verify the update has been performed, consult the Exchange schema overview.
  • When upgrading your Exchange 2013 or 2016 installation, don’t forget to put the server in maintenance mode when required. Regardless, setup will put the server in server-wide offline mode post-analysis, before making actual changes.
  • Using Windows Management Framework (WMF)/PowerShell version 5 or later on anything earlier than Windows Server 2016 is not supported. Don’t install WMF5 on your Exchange servers running on Windows Server 2012 R2 or earlier.
  • When using Exchange hybrid deployments or Exchange Online Archiving (EOA), you are required to stay at most one version behind (n-1).
  • If you want to speed up the update process for systems without internet access, you can follow the procedure described here to disable publisher’s certificate revocation checking.
  • Cumulative Updates can be installed directly, i.e. no need to install RTM prior to installing Cumulative Updates.
  • Once installed, you can’t uninstall a Cumulative Update nor any of the installed Exchange server roles.
  • The order in which you upgrade servers with Cumulative Updates is irrelevant.

Caution: As for any update, I recommend to thoroughly test updates in a test environment prior to implementing them in production. When you lack such facilities, hold out a few days and monitor the comments on the original publication or forums for any issues.