Security Updates Exchange 2016-2019 & SE (Dec2025)

Posted on December 10, 2025 by Michel de Rooij

The Exchange product group released the December 2025 Security Update for Exchange Server SE. Organizations that enrolled in the Extended Security Update program will also have access to December 2025 security updates for Exchange Server 2019 and Exchange Server 2016. These ESU updates will not be made available publicly.

The vulnerabilities addressed in these Security Updates for Exchange Server are:

Vulnerability	Category	Severity	Rating
CVE-2025-64666	Elevation of Privilege	Important	CVSS:3.1 7.5 / 6.5
CVE-2025-64667	Spoofing	Important	CVSS:3.1 5.3 / 4.6

The Security Updates for each supported Exchange Server build are linked below:

Exchange	SU/HU	Download	Build	KB	Supersedes
Exchange SE	4	Download	15.2.2562.29	KB5071876	KB5066366
Exchange 2019 CU15	6	ESU Program	15.2.1748.42	KB5071875	KB5066367
Exchange 2019 CU14	9	ESU Program	15.2.1544.37	KB5071874	KB5066368
Exchange 2016 CU23	20	ESU Program	15.1.2507.63	KB5071873	KB5066369

Fixed Issues

The issue addressed in these hotfixes is:

Skype for Business OWA integration fails after enabling the Dedicated Hybrid Application

Notes

Security updates are Cumulative Update level specific. You cannot apply the Exchange 2019 CU15 update to Exchange 2019 CU14. When downloading, the security update might carry the same name for different Cumulative Updates. Nowadays, Microsoft adds the KB article number as a reference, but I would still tag the file name with the CU level for archival purposes, e.g., Exchange2019-CU15-KBxxxxxxx-x64-en.exe.
Like Cumulative Updates, Security Updates are cumulative, and you only need to install the latest SU for your CU.
Suppose you have deployed Exchange Management Tools to manage your on-premises Exchange Servers or installed the tools after removing the Last Exchange Server for recipient management. In that case, it is recommended that you apply the Security Update.

On a final note, as with any patch or update, it is recommended that you apply it in a test environment before implementing it in production. However, it is not recommended to wait for regular maintenance cycles when it comes to security updates; a more agile approach is preferable, and the ratings indicate the level of urgency.

Security Updates Exchange 2016-2019 & SE (Oct2025)

Posted on October 14, 2025 by Michel de Rooij

The Exchange product group released the October 2025 Security Updates for Exchange Server SE, Exchange Server 2019, and Exchange Server 2016.

The vulnerabilities addressed in these Security Updates for Exchange Server are:

Vulnerability	Category	Severity	Rating
CVE-2025-59249	Elevation of Privilege	Important	CVSS:3.1 8.8 / 7.7
CVE-2025-53782	Elevation of Privilege	Important	CVSS:3.1 8.4 / 7.3
CVE-2025-59248	Spoofing	Important	CVSS:3.1 7.5 / 6.5

The Security Updates for each supported Exchange Server build are linked below:

Exchange	SU/HU	Download	Build	KB	Supersedes
Exchange SE	3	Download	15.2.2562.29	KB5066366	KB5063224
Exchange 2019 CU15	5	Download	15.2.1748.39	KB5066367	KB5063221
Exchange 2019 CU14	8	Download	15.2.1544.36	KB5066368	KB5063222
Exchange 2016 CU23	19	Download	15.1.2507.61	KB5066369	KB5063223

Last SU for Exchange 2019 and Exchange 2016

These Security Updates are the SUs for Exchange Server 2016 and 2019 that will be publicly available. Any Extended Security Updates (ESU) that might be released between now and April 2026 for these products need to be acquired by contacting your Microsoft Account Teams.

Auth Certificate Export

Be advised that after deploying the October SU, as a security measure, Export-ExchangeCertificate can no longer be used to export of the Auth Certificate. For more information, see KB5069337.

Notes

Security updates are Cumulative Update level specific. You cannot apply the update for Exchange 2019 CU15 to Exchange 2019 CU14. When downloading, the security update might carry the same name for different Cumulative Updates. Nowadays, Microsoft adds the KB article number as a reference, but I would still tag the file name with the CU level for archival purposes, e.g., Exchange2019-CU15-KB5063221-x64-en.exe.
Like Cumulative Updates, Security Updates are cumulative, and you only need to install the latest SU for your CU.
Suppose you have deployed Exchange Management Tools to manage your on-premises Exchange Servers or installed the tools after removing the Last Exchange Server for recipient management. In that case, it is recommended that you apply the Security Update.

On a final note, as with any patch or update, it is recommended that you apply it in a test environment before implementing it in production. However, it is not recommended to wait for regular maintenance cycles when it comes to security updates and follow a more agile approach; the ratings indicate the level of urgency.

Security Updates Exchange 2016-2019 & SE (Aug2025)

Posted on August 12, 2025 by Michel de Rooij

The Exchange product group released the August 2025 Hotfix Updates for Exchange Server SE, Exchange Server 2019, and Exchange Server 2016. The SU for SE comes barely a month after the RTM release of Exchange SE RTM.

The vulnerabilities addressed in these Security Updates for Exchange Server are:

Vulnerability	Category	Severity	Rating
CVE-2025-25005	Tampering	Important	CVSS:3.1 6.5 / 5.7
CVE-2025-25006	Spoofing	Important	CVSS:3.1 5.3 / 4.6
CVE-2025-25007	Spoofing	Important	CVSS:3.1 5.3 / 4.6
CVE-2025-33051	Information Disclosure	Important	CVSS:3.1 7.5 / 6.5

The Security Updates for each supported Exchange Server build are linked below:

Exchange	SU	Download	Build	KB	Supersedes
Exchange SE	1	Download	15.2.2562.20	KB5063224
Exchange 2019 CU15	3	Download	15.2.1748.36	KB5063221	KB5049233
Exchange 2019 CU14	6	Download	15.2.1544.33	KB5063222	KB5049233
Exchange 2016 CU23	17	Download	15.1.2507.58	KB5063223	KB5049233

Feature Changes

The November SUs for Exchange 2019 and Exchange 2016 introduced AMSI integration. AMSI was disabled by default after deploying this SU. Now, with the August 2025 SUs, AMSI body scanning will be enabled for all protocols. Consult the documentation on how to disable AMSI scanning should you encounter any issues.

Fixed Issues

Apart from security fixes and added features, these Security Updates also correct the following issues:

Issue Fixed
Exchange Server fails to export eDiscovery search results to a discovery mailbox
Application pools stop responding and performance is affected after MSIPC is enabled
Incorrect ACE is modified through public folder management in Outlook

Notes

Security updates are Cumulative Update level specific. You cannot apply the update for Exchange 2019 CU15 to Exchange 2019 CU14. When downloading, the security update might carry the same name for different Cumulative Updates. Nowadays, Microsoft adds the KB article number as reference, but I would still tag the file name with the CU level for archival purposes, e.g., Exchange2019-CU15-KB5063221-x64-en.exe.
Like Cumulative Updates, Security Updates are cumulative, and you only need to install the latest SU for your CU.
Suppose you have deployed Exchange Management Tools to manage your on-premises Exchange Servers or installed the tools after removing the Last Exchange Server for recipient management. In that case, it is recommended that you apply the Security Update.

On a final note, as with any patch or update, it is recommended that you apply it in a test environment before implementing it in production. However, it is not recommended to wait for regular maintenance cycles when it comes to security updates and follow a more agile approach; the ratings indicate the level of urgency.

Exchange 2016 & 2019 ESU

Posted on July 16, 2025 by Michel de Rooij

In a somewhat surprising move yesterday, Microsoft announced there will be an Extended Security Update program for Exchange Server 2016 and Exchange Server 2019. The ESU is to cater to organizations that indicate they need some more time to move away from Exchange 2016/2019. I will not comment on the fact that these organizations had a few years to get current on Exchange 2019, which would lead them to having a smooth upgrade path now to Exchange SE, or even move to Exchange Online.

Extended Security Update

You might already be familiar with ESU programs, which are common for Windows clients and Windows Server, a.o. That said, Exchange also had its share of post-lifecycle (out-of-band) updates, such as the Hafnium security updates for Exchange 2013 and even Exchange 2010. These updates were developed and made available without any obligation as some of the updates applied to products that were past their end-of-support date.

Now, the ESU program for Exchange 2016/2019 is an official extension to keep receiving published security updates for Exchange 2016/2019. To receive these, organizations can purchase a 6-month ESU for their Exchange servers. For this, they need to contact their Microsoft account manager starting August 1st, 2025. Do note that there is no guarantee that, within this period, security updates will get published, as this is entirely driven by circumstances and urgency, of course.

To make it clear: The ESU program is not an extension of support. You cannot contact support for any incident with Exchange 2016/2019 in the ESU period. That is, unless it relates to an SU that gets published during the ESU period. Thus, ESU is more for peace of mind when it comes to security, when you can live without expecting support.

The ESU period ends April 14th, 2026, 6 months after Exchange 2016 and Exchange 2019 go out of support. It is possible to get ESU after August 1st and during the 6-month ESU window. This flexibility may lead to organizations taking a gamble, waiting for SU to appear, only to get ESU when the first SU arrives. Given that corporate purchasing processes might take some time and CUs usually come with some urgency to implement, this is not something I would recommend.

I would also not recommend seeing this ESU window as an opportunity to take it easy. The support date stands, which is what most organizations find most important. So, keep migrating, whether to Exchange SE directly or via Exchange 2019 CU15, or to Exchange Online.

Skype for Business

Skype for Business is iņ the same boat regarding lifecycle, and also has a similar ESU program. For more information, click here.

Security Updates Exchange 2016-2019 (Nov2024)

Posted on November 12, 2024 by Michel de Rooij

NOTICE (Nov27): The SUs have been re-released. The v2 adds additional control over the X-MS-Exchange-P2FromRegexMatch header, which is set for messages with a non-RFC5322 compliant P2 FROM header. Install these on your Exchange server, also if you already deployed the v1 SU to benefit from the additional control.

The Exchange product group released November 2024 updates for Exchange Server 2016 and 2019.

The vulnerabilities addressed in these Security Updates for Exchange Server are:

Vulnerability	Category	Severity	Rating
CVE-2024-49040	Spoofing	Important	CVSS:3.1 7.5 / 6.7

The v2 Security Updates for each supported Exchange Server build are linked below:

Exchange	Download	Build	KB	Supersedes
Exchange 2019 CU14	Download	15.2.1544.14	KB5044062 KB5049233	KB5036401
Exchange 2019 CU13	Download	15.2.1258.39	KB5044062 KB5049233	KB5036402
Exchange 2016 CU23	Download	15.1.2507.44	KB5044062 KB5049233	KB5036386

Added Features

Anti-Malware Scan Interface (AMSI) integration

The ability of products that use the Exchange Server AMSI integration to perform additional tasks on message bodies. The feature is disabled by default. You can enable it on a protocol base like Exchange Web Services or PowerShell. More information on this feature here.

Non-RFC5322 compliant header detection

Similar to the change in Exchange Online mentioned in MC886603, after installing this SU, messages with a non-compliant P2 FROM header (RFC5322) will be detected. Unlike Exchange Online, which will drop these messages, Exchange will add a header that can be used in transport rules as organizations see fit. To be compliant, organizations should ensure messages with multiple From addresses include a Sender header. More information here.

Elliptic Curve Cryptography (ECC) certificate support

ECC certificates can now be used on Edge Transport servers and bound to the POP and IMAP services. Note that unlike the previous implementation, which required enabling using New-SettingOverride, they are now configured through a registry key, i.e.

New-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\ExchangeServer\v15\Diagnostics" -Name "EnableEccCertificateSupport" -Value 1 -Type String

More information here.

Microsoft Information Protection Client (MSIPC)

MSIPC will now ne enabled by default, replacing Microsoft Digital Rights Management (MSDRM) for information rights management.

Fixed Issues

Apart from security fixes and added features, these Security Updates also correct the following issues:

Issue Fixed	Exchange 2016	Exchange 2019
Journal report decryption doesn’t decrypt attachment in journal mailbox	Yes	Yes
Error after adding support for AES256-CBC–encrypted content in August 2023 SU	Yes	Yes
Exchange can’t decrypt IRM messages	Yes
Server with PowerShell_ISE doesn’t serialize when connecting to EMS	Yes	Yes
Email sent through Pickup folder displays admin version	Yes	Yes
CSR created by Exchange are signed with outdated Encryption algorithm	Yes	Yes
OWA displays incorrect time zone for Amman	Yes	Yes
Kazakhstan changes to single time zone in 2024	Yes	Yes
Moderated messages are marked as expired after they are approved or rejected		Yes
Exchange Transport Rules and Data Loss Prevention rules don’t work after installing November 2024 SU V1	Yes	Yes

Notes

Security updates are Cumulative Update level specific. You cannot apply the update for Exchange 2019 CU14 to Exchange 2019 CU13. When downloading, the security update will carry the same name for different Cumulative Updates, and I suggest tagging the file name with the CU level when archiving it, e.g., Exchange2019-CU14-KBXXXXXX-x64-en.msp.
Like Cumulative Updates, Security Updates are cumulative, and you only need to install the latest SU for your CU.
If you have deployed Exchange Management Tools to manage your on-premises Exchange Servers or installed the tools after removing the Last Exchange Server for recipient management, it is recommended that you apply the Security Update. Be aware of a few cmdlet piping issues mentioned here.

On a final note, as with any patch or update, it is recommended that you apply it in a test environment before implementing it in production. However, it is not recommended to wait for regular maintenance cycles when it concerns security updates and follow a more agile approach; the ratings indicate the level of urgency.