Windows Server patches breaking Exchange.

Posted on by
Reply
alarm

Updated Oct17: Added official information and link to OWA item on the Windows Server known issues list.

A heads-up not directly related to the October Exchange SUs, but important if you run Exchange on-premises: Reports indicate that last Tuesday’s Windows Server patches might break Exchange functionality.

The Windows Server updates that might cause issues are:

Symptoms

Official and user-reported symptoms include:

  • OWA and Outlook losing mailbox connectivity.
  • External and internal messages accumulating in mail queues.
  • DAG copies no longer replicating; switchovers might not function.
  • EAC still showing databases as mounted when they are not.

Also, the following event might be logged in the Application event log:

Source: MSExchange Mailbox Replication
Event ID: 1006
Description: The Microsoft Exchange Mailbox Replication service was unable to process jobs in a mailbox database.
Database: <Mailbox DB>
Error: MapiExceptionMdbOffline: Unable to make connection to the server. (hr=0x80004005, ec=1142).

You might want to check your event log using:

Get-WinEvent -FilterHashtable @{ LogName='Application'; Id=1006; StartTime=(Get-Date).AddDays(-1); ProviderName='MSExchange Mailbox Replication' }

These symptoms start around 24 hours after installing the Windows Update. Rebooting the server temporarily resolves the issue, but symptoms may reappear after the same interval.

RPC Endpoint Mapper

As originally noted in the comments on a German website, Frankyweb, someone noticed these Windows Server updates introduce a 512-stored-search-contexts limit in RpcEpMap.dll (RPC Endpoint Mapper). A search context is how RPC keeps track of which service runs on which port/interface. Microsoft likely introduced this limit to mitigate CVE-2026-96300, which addresses “Uncontrolled resource consumption” that could lead to denial-of-service attacks. Because Exchange might create a larger number of requests simultaneously, and only releases them when the related Exchange process terminates, you might run into RPC port exhaustion.

This sounds like a plausible explanation, as I noticed on my setup, which hosts a Database Availability Group, the event log contains the following “no more endpoints available” events around the same time the 1006 events start to show up:

Source: MSExchangeRepl
Event ID: 4082
Description: The replication network manager encountered an error while monitoring events. Error: Microsoft.Exchange.Cluster.Shared.ClusterApiException: An error occurred while attempting a cluster operation. Error: Cluster API failed: “OpenCluster( … ) failed with 0x6d9. Error: There are no more endpoints available from the endpoint mapper” —> System.ComponentModel.Win32Exception: There are no more endpoints available from the endpoint mapper

The ~24-hour interval also makes sense, as the search contexts slowly fill up. A reboot would clear them.

Workaround

The website suggests a temporary workaround: set the saved search contexts registry key to something bigger than the default of 512, e.g., 65536 or 16777215:

New-ItemProperty -Path HKLM\SOFTWARE\Microsoft\Rpc -Name EpmapSavedContextCap -Value 16777215 -Force

Be advised that this undermines CVE-2026-96300. To remove the key again:

Remove-ItemProperty -Path HKLM:\SOFTWARE\Microsoft\Rpc -Name EpmapSavedContextCap

Needless to say, the above puts a band-aid on your servers until Microsoft releases an official fix.

Official statement

End of October 17, the Exchange team published a blog confirming the issue, recommending against uninstalling the Windows Server updates, and implementing the above registry key. Recommendation is to set it initially to 65536, and raise the number should issues still occur. Implementing the registry key is considered a temporary mitigation. Note that the official statement claims this issue “might happen under load”, but I have seen it occur in my lab environment, which I can assure you, is not under load.

The Windows Server known issues page contains information on the OWA issue:
Users might be unable to sign in to OWA or send emails on Exchange Server. Mysteriously, it also states, “An additional mitigation is available for affected devices through Microsoft Support”. This might lead to speculation that a more permanent solution is in the works, such as an update for the RPC Endpoint Mapper code, or an Out of Band update for related Exchange code.

Officialy, Microsoft is still investigating this issue. I will update the post as information becomes available.

Security Updates Exchange 2016-SE (Oct2026)

Posted on by
Reply

The Exchange product group released the October 2026 updates for Exchange Server SE, Exchange 2019, and Exchange 2016. The Security Update for Exchange SE is publicly available. Security updates for Exchange 2019 and Exchange 2016 are available to organizations enrolled in the Extended Security Update Period 2 program.

Note: These are the final Security Updates for Exchange 2016 and Exchange 2019. As of now, Microsoft will not test Exchange 2019 or Exchange 2016 for new CVEs, and they will not receive any further SUs. The ESU2 program will be available for a while, but it will only bring you up to the October 2026 SU level.

The vulnerabilities addressed in these Security Updates are:

VulnerabilityCategorySeverityRating
CVE-2026-70571Remote Code ExecutionCriticalCVSS:3.1 8.1 / 7.1
CVE-2026-77910Elevation of PrivilegeImportantCVSS:3.1 8.8 / 7.7
CVE-2026-87692Elevation of PrivilegeImportantCVSS:3.1 7.8 / 6.8
CVE-2026-87695Elevation of PrivilegeImportantCVSS:3.1 7.8 / 6.8
CVE-2026-87696Elevation of PrivilegeImportantCVSS:3.1 7.5 / 6.5
CVE-2026-70279Spoofing VulnerabilityImportantCVSS:3.1 9.3 / 8.1

The Security Updates for each supported Exchange Server build are linked below:

ExchangeHU/SuDownloadBuildKBSupersedes
Exchange SE11Download15.2.2562.56KB5128895KB5129955
Exchange 2019 CU1512ESU215.2.1748.55KB5128896KB5129956
Exchange 2019 CU1415ESU215.2.1544.50KB5128897KB5129957
Exchange 2016 CU2326ESU215.1.2507.77KB5128898KB5129958

Issues resolved

Notes

  • Security updates are specific to the Cumulative Update level. You cannot apply the Exchange 2019 CU15 security update to Exchange 2019 CU14. When downloading, the security update may have the same name across different Cumulative Updates. Microsoft now includes the KB article number as a reference, but I still tag the filename with the CU level for archival purposes, e.g., Exchange2019-CU15-KBxxxxxxx-x64-en.exe.
  • Like Cumulative Updates, Security Updates are cumulative, and you only need to install the latest SU for your CU.
  • If you deployed Exchange Management Tools to manage your on-premises Exchange Servers, or installed the tools after removing the Last Exchange Server for recipient management, we recommend applying the Security Update.

Finally, as with any patch or update, test it in a test environment before deploying it to production. However, we do not recommend waiting for regular maintenance cycles for security updates; a more agile approach is preferable, and the ratings indicate the urgency level.

V2 Security Updates Exchange 2016-SE (Sep2026)

Posted on by
Reply

The Exchange product group released an update for the September 2026 updates for Exchange Server SE, Exchange 2019, and Exchange 2016. The Security Update for Exchange SE is publicly available. Security updates for Exchange 2019 and Exchange 2016 are available to organizations enrolled in the Extended Security Update Period 2 program.

The vulnerability addressed in these V2 Security Updates for Exchange Server is:

VulnerabilityCategorySeverityRating
CVE-2026-96940Elevation of PrivilegeImportantCVSS:3.1 8.8 / 7.7

To clarify: The V2 security updates address this CVE in addition to the CVE addressed by the original September Security Updates. Known Issues and Fixed Issues from the original September Security Updates also apply to V2.

The V2 Security Updates for each supported Exchange Server build are linked below:

ExchangeHU/SuDownloadBuildKBSupersedes
Exchange SE10v2Download15.2.2562.53KB5129955KB5121608
Exchange 2019 CU1511v2ESU215.2.1748.53KB5129956KB5121609
Exchange 2019 CU1414v2ESU215.2.1544.48KB5129957KB5121610
Exchange 2016 CU2325v2ESU215.1.2507.75KB5129958KB5121611

Known Issues

Notes

  • Security updates are specific to the Cumulative Update level. You cannot apply the Exchange 2019 CU15 security update to Exchange 2019 CU14. When downloading, the security update might carry the same name for different Cumulative Updates. Microsoft now includes the KB article number as a reference, but I still tag the filename with the CU level for archival purposes, e.g., Exchange2019-CU15-KBxxxxxxx-x64-en.exe.
  • Like Cumulative Updates, Security Updates are cumulative, and you only need to install the latest SU for your CU.
  • Suppose you have deployed Exchange Management Tools to manage your on-premises Exchange Servers or installed the tools after removing the Last Exchange Server for recipient management. We recommend applying the Security Update.

Finally, as with any patch or update, test it in a test environment before deploying it to production. However, we do not recommend waiting for regular maintenance cycles for security updates; a more agile approach is preferable, and the ratings indicate the urgency level.

Security Updates Exchange 2016-SE (Sep2026)

Posted on by
Reply

The Exchange product group released the September 2026 updates for Exchange Server SE, Exchange 2019, and Exchange 2016. The Security Update for Exchange SE is publicly available. Security updates for Exchange 2019 and Exchange 2016 are available to organizations enrolled in the Extended Security Update Period 2 program.

The vulnerabilities addressed in these Security Updates for Exchange Server are:

VulnerabilityCategorySeverityRating
CVE-2026-55007Remote Code ExecutionImportantCVSS:3.1 8.1 / 7.1
CVE-2026-69355Remote Code ExecutionImportantCVSS:3.1 8.8 / 7.7
CVE-2026-69356SpoofingImportantCVSS:3.1 9.3 / 8.1
CVE-2026-69361SpoofingImportantCVSS:3.1 6.5 / 5.7
CVE-2026-69375TamperingImportantCVSS:3.1 6.5 / 5.7
CVE-2026-69378Denial of ServiceImportantCVSS:3.1 7.5 / 6.5
CVE-2026-69380Elevation of PrivilegeImportantCVSS:3.1 8.1 / 7.1
CVE-2026-69382Information DisclosureImportantCVSS:3.1 5.9 / 5.2
CVE-2026-69641Elevation of PrivilegeImportantCVSS:3.1 9.1 / 7.9

Note: CVE-2026-55007 does not apply to Exchange Server 2016.

The Security Updates for each supported Exchange Server build are linked below:

ExchangeSU/HUDownloadBuildKBSupersedes
Exchange SE10Download15.2.2562.49KB5121608KB5121573
Exchange 2019 CU1511ESU215.2.1748.51KB5121609KB5121574
Exchange 2019 CU1414ESU215.2.1544.46KB5121610KB5121575
Exchange 2016 CU2325ESU215.1.2507.73KB5121611KB5121576

Fixed Issues

The SU resolves the following issues from previous updates:

Known Issues

Be aware of the following known issue after installing the SU:

Notes

  • Security updates are specific to the Cumulative Update level. You cannot apply the Exchange 2019 CU15 security update to Exchange 2019 CU14. When downloading, the security update might carry the same name for different Cumulative Updates. Microsoft now includes the KB article number as a reference, but I still tag the filename with the CU level for archival purposes, e.g., Exchange2019-CU15-KBxxxxxxx-x64-en.exe.
  • Like Cumulative Updates, Security Updates are cumulative, and you only need to install the latest SU for your CU.
  • Suppose you have deployed Exchange Management Tools to manage your on-premises Exchange Servers or installed the tools after removing the Last Exchange Server for recipient management. We recommend applying the Security Update.

Finally, as with any patch or update, test it in a test environment before deploying it to production. However, we do not recommend waiting for regular maintenance cycles for security updates; a more agile approach is preferable, and the ratings indicate the urgency level.

Security Updates Exchange 2016-SE (Aug2026)

Posted on by
Reply

The Exchange product group released the Augustus 2026 updates for Exchange Server SE, as well as Exchange 2019 and 2016. The Security Update for Exchange SE is available to the public. Security updates for Exchange 2019 and Exchange 2016 are available to organizations enrolled in the Extended Security Update Period 2 program.

The vulnerabilities addressed in these Security Updates for Exchange Server are:

VulnerabilityCategorySeverityRating
CVE-2026-65813Elevation of PrivilegeImportantCVSS:3.1 6.5 / 5.7
CVE-2026-62915Security Feature BypassImportantCVSS:3.1 6.5 / 5.7
CVE-2026-62914SpoofingImportantCVSS:3.1 7.3 / 6.4
CVE-2026-62913Remote Code ExecutionImportantCVSS:3.1 8.8 / 7.7
CVE-2026-62912Denial of ServiceImportantCVSS:3.1 6.5 / 5.7
CVE-2026-62911Elevation of PrivilegeImportantCVSS:3.1 8.0 / 7.0
CVE-2026-62910Elevation of PrivilegeCriticalCVSS:3.1 7.2 / 6.3
CVE-2026-55009Elevation of PrivilegeImportantCVSS:3.1 7.8 / 6.8

The Security Updates for each supported Exchange Server build are linked below:

ExchangeSU/HUDownloadBuildKBSupersedes
Exchange SE9Download15.2.2562.46KB5121573KB5103212
Exchange 2019 CU1510ESU Period 215.2.1748.49KB5121574KB5103213
Exchange 2019 CU1413ESU Period 215.2.1544.44KB5121575KB5103214
Exchange 2016 CU2324ESU Period 215.1.2507.72KB5121576KB5103215

Known Issue

Be aware of the following issue after installing these SU:

OWA Light

Starting with this SU, the OWA Light client will be permanently disabled. See related CVE-2026-62914 for more information. If you cannot install the August SU for some reason, it is recommended to disable OWA Light manually, e.g.

# To disable OWA Light in applicable Mailbox Policies
Set-OwaMailboxPolicy -OwaLightEnabled $false

# To disable OWA Light option in the OWA interface
Set-OwaVirtualDirectory -LogonPageLightSelectionEnabled $false

Notes

  • Security updates are specific to the Cumulative Update level. You cannot apply the Exchange 2019 CU15 security update to Exchange 2019 CU14. When downloading, the security update might carry the same name for different Cumulative Updates. Nowadays, Microsoft includes the KB article number as a reference, but I would still tag the filename with the CU level for archival purposes, e.g., Exchange2019-CU15-KBxxxxxxx-x64-en.exe.
  • Like Cumulative Updates, Security Updates are cumulative, and you only need to install the latest SU for your CU.
  • Suppose you have deployed Exchange Management Tools to manage your on-premises Exchange Servers or installed the tools after removing the Last Exchange Server for recipient management. It is recommended that you apply the Security Update.

On a final note, as with any patch or update, it is recommended that you test it in a test environment before deploying it to production. However, it is not recommended to wait for regular maintenance cycles for security updates; a more agile approach is preferable, and the ratings indicate the urgency level.