Exchange Server updates

Exchange Server updates

• Exchange Server Subscription Edition RTM Exchange Server Subscription Edition RTM Security update

  Updated Nov 10

  KB5133453 Nov 10, 2026

  Critical mail-server flaw patched; hybrid free/busy corrected

  A critical remote-code flaw in Exchange is patched. Hybrid users can also see correct free/busy details in classic Outlook.

  Key changes 9 CVEs · 2 changes

  • Fix Free/busy availability: On-premises users in hybrid setups can see correct free/busy details for Exchange Online mailboxes in classic Outlook.
  • Fix Server stability: Exchange server instability after the October 2026 Windows Server updates is resolved by installing the November 2026 Windows Server up...
  • Critical CVE-2026-118207: Microsoft Exchange Server Remote Code Execution Vulnerability

  Read update → Source: Microsoft ↗

• Exchange Server Subscription Edition RTM Exchange Server Subscription Edition RTM Security update

  Updated Nov 10

  KB5128895 Oct 13, 2026

  Critical remote-code-execution flaw patched; calendar feeds restored

  The update fixes a Critical remote-code-execution vulnerability and restores published calendar feeds and Korean-language search processing affected by earlier updates.

  Check the newer update, KB5133453

  Key changes 6 CVEs · 2 changes

  • Fix Published calendar (.ics): Subscriptions to anonymously published calendars refresh again instead of returning an HTTP 500 error.
  • Fix ContentEngine: Processing Korean-language email no longer triggers the deadlock described in the issue, which could cause missing search results, dela...
  • Critical CVE-2026-70571: Microsoft Exchange Server Remote Code Execution Vulnerability

  Read update → Source: Microsoft ↗

• Exchange Server 2019 CU15 Exchange Server 2019 CU15 ESU only Security update

  Final update for this version

  KB5128896 Oct 13, 2026

  Critical remote-code flaw patched; calendar feeds restored

  Fixes a critical Exchange Server remote-code execution vulnerability and restores published calendar subscriptions that returned HTTP 500 errors.

  Exchange Server 2019 ESU security updates end on October 31, 2026. Only organizations enrolled in the Period 2 ESU program are eligible for this update.

  Key changes 6 CVEs · 2 changes

  • Fix Security: Exchange Server is protected against six security vulnerabilities, including a critical flaw that could allow remote code execution.
  • Fix Published calendars: Subscriptions to published calendars work again instead of returning HTTP 500 errors.
  • Critical CVE-2026-70571: Microsoft Exchange Server Remote Code Execution Vulnerability

  Read update → Source: Microsoft ↗

• Exchange Server 2019 CU14 Exchange Server 2019 CU14 ESU only Security update

  Final update for this version

  KB5128897 Oct 13, 2026

  Remote-code-execution flaw patched; published calendar errors fixed

  Addresses six Exchange Server vulnerabilities, including one critical flaw, and resolves HTTP 500 errors affecting published calendar subscriptions. It is available only to organizations enrolled in the Extended Security Update program.

  Exchange Server 2019 has reached end of support. Organizations not enrolled in ESU should migrate to Exchange Server Subscription Edition to continue receiving security updates.

  Key changes 6 CVEs · 2 changes

  • Fix Exchange Server: The update addresses six security vulnerabilities, including one critical remote-code-execution flaw.
  • Fix Published calendars (.ics): Published calendar subscriptions that return HTTP 500 are resolved by this update.
  • Critical CVE-2026-70571: Microsoft Exchange Server Remote Code Execution Vulnerability

  Read update → Source: Microsoft ↗

• Exchange Server 2016 CU23 Exchange Server 2016 CU23 ESU only Security update

  Final update for this version

  KB5128898 Oct 13, 2026

  Critical remote-code flaw and published-calendar errors addressed

  Fixes six Exchange Server vulnerabilities, including one critical remote-code-execution flaw, and resolves an issue that stopped published calendar subscriptions from refreshing. It is available only to organizations enrolled in the Extended Security Update program.

  Organizations enrolled in Period 2 ESU can receive Exchange Server 2016 security updates only through the end of October 2026.

  Key changes 6 CVEs · 2 changes

  • Fix Exchange Server: Exchange Server closes six security vulnerabilities, including a critical flaw that could allow remote code execution.
  • Fix Published calendars: Subscriptions to anonymously published calendars refresh again instead of stopping with an HTTP 500 error.
  • Critical CVE-2026-70571: Microsoft Exchange Server Remote Code Execution Vulnerability

  Read update → Source: Microsoft ↗

• Exchange Server Subscription Edition RTM Exchange Server Subscription Edition RTM Out-of-band security update

  Out-of-band

  KB5129955 Oct 2, 2026

  Exchange vulnerabilities patched; hybrid free/busy times corrected

  Nine Exchange vulnerabilities are addressed, and two hybrid mailbox problems are resolved: wrapper messages in shared mailboxes and shifted free/busy times.

  Check the newer update, KB5128895

  Known issues: 3 open Organizations and IT administrators

  • Published calendar (.ics) returns HTTP 500 for calendar applications
  • Availability (free/busy) fails for delegated mailboxes in Exchange hybrid deployments using Graph API only
  • A ContentEngine deadlock occurs because of missing Korean WordBreaker rule files

  Key changes 9 CVEs · 2 changes

  • Fix Shared mailboxes: Wrapper messages no longer appear in shared mailboxes in hybrid environments.
  • Fix Hybrid free/busy: Free/busy results no longer show busy times shifted by the requester’s time zone.
  • CVSS 8.8 CVE-2026-96940: Microsoft Exchange Server Elevation of Privilege Vulnerability

  Read update → Source: Microsoft ↗

• Exchange Server 2019 CU15 Exchange Server 2019 CU15 ESU only Out-of-band security update

  Out-of-band

  KB5129956 Oct 2, 2026

  Published calendar feeds can fail with HTTP 500

  Addresses 9 vulnerabilities in Exchange Server 2019 CU15. A known issue can stop published calendar subscriptions from refreshing and return HTTP 500; an IIS workaround is available.

  Check the newer update, KB5128896

  Exchange Server 2019 has reached end of support. Period 2 ESU organizations can receive security updates only through the end of October 2026.

  Known issues: 1 open Organizations and IT administrators

  • Published calendar (.ics) returns HTTP 500 for calendar applications

  Key changes 9 CVEs · 1 change

  • Fix Hybrid shared mailboxes: In hybrid setups, messages sent as or on behalf of a shared mailbox no longer also arrive in its Inbox as wrapper attachments.
  • CVSS 8.8 CVE-2026-96940: Microsoft Exchange Server Elevation of Privilege Vulnerability
  • Security CVE-2026-55007: Microsoft Exchange Server Remote Code Execution Vulnerability

  Read update → Source: Microsoft ↗

• Exchange Server 2019 CU14 Exchange Server 2019 CU14 ESU only Out-of-band security update

  Out-of-band

  KB5129957 Oct 2, 2026

  Hybrid shared-mailbox wrapper messages fixed; calendar feeds may fail

  Fixes a hybrid shared-mailbox message issue and addresses 9 vulnerabilities. It is available only to organizations in the Period 2 ESU program; published calendar feeds can still return HTTP 500.

  Check the newer update, KB5128897

  Period 2 ESU organizations are eligible for Exchange Server 2019 security updates through the end of October 2026. Organizations not enrolled should migrate to Exchange Server Subscription Edition to continue receiving the latest security updates.

  Known issues: 1 open Organizations and IT administrators

  • Published calendar (.ics) returns HTTP 500 for calendar applications

  Key changes 9 CVEs · 1 change

  • Fix Shared mailbox: In a hybrid deployment, messages sent as or on behalf of a shared mailbox hosted in Exchange Online no longer also appear in that mailb...
  • CVSS 8.8 CVE-2026-96940: Microsoft Exchange Server Elevation of Privilege Vulnerability
  • Security CVE-2026-55007: Microsoft Exchange Server Remote Code Execution Vulnerability

  Read update → Source: Microsoft ↗

• Exchange Server 2016 CU23 Exchange Server 2016 CU23 ESU only Out-of-band security update

  Out-of-band

  KB5129958 Oct 2, 2026

  Shared mailbox wrapper messages fixed; published calendars can fail

  Fixes wrapper messages appearing in shared mailboxes in hybrid environments. Published calendar subscriptions can still return HTTP 500; KB5128898 later resolves the issue for Exchange Server 2016 CU23.

  Check the newer update, KB5128898

  Exchange Server 2016 is out of support. Period 2 ESU organizations can receive security updates through October 31, 2026.

  Known issues: 1 open Organizations and IT administrators

  • Published calendar (.ics) returns HTTP 500 for calendar applications

  Key changes 9 CVEs · 1 change

  • Fix Shared mailbox: In certain hybrid deployments, messages sent as or on behalf of a shared mailbox no longer also arrive in its Inbox as attachments with...
  • CVSS 8.8 CVE-2026-96940: Microsoft Exchange Server Elevation of Privilege Vulnerability
  • Security CVE-2026-55007: Microsoft Exchange Server Remote Code Execution Vulnerability

  Read update → Source: Microsoft ↗

• Exchange Server Subscription Edition RTM Exchange Server Subscription Edition RTM Security update

  KB5121608 Sep 8, 2026

  Exchange vulnerabilities addressed; published calendar feeds may fail

  Security flaws are addressed, but published calendar feeds and Korean-content processing have known issues.

  Check the newer update, KB5129955

  Known issues: 3 open Organizations and IT administrators

  • Published calendar (.ics) returns HTTP 500 for calendar applications
  • Availability (free/busy) fails for delegated mailboxes in Exchange hybrid deployments using Graph API only
  • A ContentEngine deadlock occurs because of missing Korean WordBreaker rule files

  Key changes 9 CVEs · 2 changes

  • Fix Shared mailboxes: In the hybrid setup described in the issue article, wrapper messages no longer appear in shared mailbox inboxes.
  • Fix Free/busy: Hybrid free/busy results no longer shift busy times by the requester's time zone in the scenario described.
  • CVSS 9.3 CVE-2026-69356: Microsoft Exchange Server Spoofing Vulnerability

  Read update → Source: Microsoft ↗

• Exchange Server 2019 CU15 Exchange Server 2019 CU15 ESU only Security update

  KB5121609 Sep 8, 2026

  Published calendar feeds can fail; hybrid sent-mail copies fixed

  Security vulnerabilities are addressed, and a hybrid shared-mailbox message-copy problem is fixed. Published calendar subscriptions can still return HTTP 500; a workaround is available.

  Check the newer update, KB5129956

  Exchange Server 2019 has reached end of support. Period 2 ESU organizations can receive security updates until the end of October 2026.

  Known issues: 1 open Organizations and IT administrators

  • Published calendar (.ics) returns HTTP 500 for calendar applications

  Key changes 9 CVEs · 2 changes

  • Fix Security: Security vulnerabilities in the server are addressed.
  • Fix Shared mailboxes: In some hybrid setups, sent-as or sent-on-behalf messages no longer also appear as attachments in a shared mailbox's Inbox.
  • CVSS 9.3 CVE-2026-69356: Microsoft Exchange Server Spoofing Vulnerability

  Read update → Source: Microsoft ↗

• Exchange Server 2019 CU14 Exchange Server 2019 CU14 ESU only Security update

  KB5121610 Sep 8, 2026

  Exchange security flaws addressed; hybrid mailbox wrappers fixed

  Security flaws are addressed, and a hybrid shared-mailbox message issue is fixed under specific mailbox and permission settings. Published calendar subscriptions stop refreshing and return HTTP 500 errors.

  Check the newer update, KB5129957

  Exchange Server 2019 is out of support. Period 2 ESU organizations can receive security updates through October 31, 2026.

  Known issues: 1 open Organizations and IT administrators

  • Published calendar (.ics) returns HTTP 500 for calendar applications

  Key changes 9 CVEs · 2 changes

  • Fix Exchange Server: Security flaws in Exchange Server are addressed.
  • Fix Shared mailboxes: In hybrid setups, sent-as or sent-on-behalf messages may also reach a shared mailbox as wrapper attachments. The shared mailbox is in E...
  • CVSS 9.3 CVE-2026-69356: Microsoft Exchange Server Spoofing Vulnerability

  Read update → Source: Microsoft ↗

• Exchange Server 2016 CU23 Exchange Server 2016 CU23 ESU only Security update

  KB5121611 Sep 8, 2026

  Eight security flaws addressed; published calendar feeds can fail

  Addresses eight Important vulnerabilities and fixes wrapper messages appearing in shared mailboxes in hybrid deployments. Published calendar subscriptions can still return HTTP 500.

  Check the newer update, KB5129958

  Exchange Server 2016 has reached end of support. Only organizations enrolled in the Period 2 Extended Security Update program are eligible for security updates through the end of October 2026; organizations not enrolled should migrate to Exchange Server Subscription Edition.

  Known issues: 1 open Organizations and IT administrators

  • Published calendar (.ics) returns HTTP 500 for calendar applications

  Key changes 8 CVEs · 1 change

  • Fix Hybrid deployments: In certain hybrid deployments, messages sent as or on behalf of an Exchange Online shared mailbox no longer might also arrive in its In...
  • CVSS 9.3 CVE-2026-69356: Microsoft Exchange Server Spoofing Vulnerability
  • CVSS 9.1 CVE-2026-69641: Microsoft Exchange Server Elevation of Privilege Vulnerability

  Read update → Source: Microsoft ↗

• Exchange Server Subscription Edition RTM Exchange Server Subscription Edition RTM Security update

  KB5121573 Aug 11, 2026

  Exchange privilege flaw addressed; published calendar feeds can fail

  A critical Exchange privilege-escalation flaw is addressed. Published calendar subscriptions might stop refreshing and return HTTP 500.

  Check the newer update, KB5121608

  Known issues: 3 open Organizations and IT administrators

  • Published calendar (.ics) returns HTTP 500 for calendar applications
  • Availability (free/busy) fails for delegated mailboxes in Exchange hybrid deployments using Graph API only
  • Wrapper messages appear in shared mailbox in hybrid environments after installing the June 2026 Security Update

  Key changes 7 CVEs · 1 change

  • Fix Exchange Server: The update addresses a critical flaw that could let an attacker gain higher privileges in Exchange Server.
  • Critical CVE-2026-62911: Microsoft Exchange Server Elevation of Privilege Vulnerability
  • CVSS 8.8 CVE-2026-62913: Microsoft Exchange Server Remote Code Execution Vulnerability

  Read update → Source: Microsoft ↗

• Exchange Server 2019 CU15 Exchange Server 2019 CU15 ESU only Security update

  KB5121574 Aug 11, 2026

  Critical privilege-escalation flaw in the mail server addressed

  A critical flaw could let attackers gain higher privileges on the mail server. Only organizations enrolled in the Extended Security Update program can receive this release.

  Check the newer update, KB5121609

  Period 2 ESU organizations can receive security updates through the end of October 2026.

  Known issues: 2 open Organizations and IT administrators

  • Published calendar (.ics) returns HTTP 500 for calendar applications
  • Wrapper messages appear in shared mailbox in hybrid environments after installing the June 2026 Security Update

  Key changes 7 CVEs · 1 change

  • Fix Exchange Server: A critical flaw could let attackers gain higher privileges on the mail server.
  • Critical CVE-2026-62911: Microsoft Exchange Server Elevation of Privilege Vulnerability
  • CVSS 8.8 CVE-2026-62913: Microsoft Exchange Server Remote Code Execution Vulnerability

  Read update → Source: Microsoft ↗

• Exchange Server 2019 CU14 Exchange Server 2019 CU14 ESU only Security update

  KB5121575 Aug 11, 2026

  Critical Exchange privilege flaw covered; CU14 ESU ends in October

  A critical Exchange privilege flaw is addressed. CU14 security updates are available only to ESU organizations through October 31, 2026.

  Check the newer update, KB5121610

  Exchange Server 2019 has reached end of support. ESU security updates are available to enrolled organizations through October 2026.

  Known issues: 2 open Organizations and IT administrators

  • Published calendar (.ics) returns HTTP 500 for calendar applications
  • Wrapper messages appear in shared mailbox in hybrid environments after installing the June 2026 Security Update

  Key changes 7 CVEs · 1 change

  • Fix Exchange Server: The update addresses vulnerabilities in Exchange Server.
  • Critical CVE-2026-62911: Microsoft Exchange Server Elevation of Privilege Vulnerability
  • CVSS 8.8 CVE-2026-62913: Microsoft Exchange Server Remote Code Execution Vulnerability

  Read update → Source: Microsoft ↗

• Exchange Server 2016 CU23 Exchange Server 2016 CU23 ESU only Security update

  KB5121576 Aug 11, 2026

  Critical mailbox privilege flaw; shared-mailbox wrappers persist

  A critical elevation-of-privilege flaw in Exchange is fixed. Two known issues remain, including wrapper messages in shared mailboxes in hybrid setups.

  Check the newer update, KB5121611

  Only organizations enrolled in Period 2 ESU can receive security updates through the end of October 2026. Other organizations should migrate to Exchange Server Subscription Edition.

  Known issues: 2 open Organizations and IT administrators

  • Published calendar (.ics) returns HTTP 500 for calendar applications
  • Wrapper messages appear in shared mailbox in hybrid environments after installing the June 2026 Security Update

  Key security notes 7 CVEs

  • Critical CVE-2026-62911: Microsoft Exchange Server Elevation of Privilege Vulnerability
  • CVSS 8.8 CVE-2026-62913: Microsoft Exchange Server Remote Code Execution Vulnerability
  • CVSS 7.3 CVE-2026-62914: Microsoft Exchange Server Spoofing Vulnerability

  Read update → Source: Microsoft ↗

• Exchange Server Subscription Edition RTM Exchange Server Subscription Edition RTM Security update

  KB5103212 Jul 14, 2026

  Critical Exchange spoofing flaw addressed; mailbox issue remains

  A critical Exchange spoofing vulnerability is addressed. Hybrid shared mailboxes might still receive wrapper messages after the June security update; KB5121608 or later resolves the issue.

  Check the newer update, KB5121573

  Known issues: 1 open Organizations and IT administrators

  • Wrapper messages appear in shared mailbox in hybrid environments after installing the June 2026 Security Update

  Key changes 11 CVEs · 1 change

  • Fix Exchange Server: Exchange Server's critical spoofing vulnerability is addressed.
  • Critical CVE-2026-55008: Microsoft Exchange Server Spoofing Vulnerability
  • CVSS 8.8 CVE-2026-45504: Microsoft Exchange Server Elevation of Privilege Vulnerability

  Read update → Source: Microsoft ↗

• Exchange Server 2019 CU15 Exchange Server 2019 CU15 ESU only Security update

  KB5103213 Jul 14, 2026

  Mail-server spoofing, code-execution and privilege flaws addressed

  Addresses 11 vulnerabilities in Exchange Server, including one Critical flaw. It is available only to organizations enrolled in the Extended Security Update program.

  Check the newer update, KB5121574

  Extended Security Updates for Exchange Server 2019 end on October 31, 2026.

  Key changes 11 CVEs · 4 changes

  • Fix Exchange Server: Closes a remote code execution vulnerability in Exchange Server.
  • Fix Exchange Server: Closes an elevation of privilege vulnerability in Exchange Server.
  • Fix Exchange Server: Closes a spoofing vulnerability in Exchange Server.

  Read update → Source: Microsoft ↗

• Exchange Server 2019 CU14 Exchange Server 2019 CU14 ESU only Security update

  KB5103214 Jul 14, 2026

  Critical mail-server spoofing flaw addressed

  Addresses 11 vulnerabilities in Exchange Server 2019 CU14, including one critical spoofing flaw (CVE-2026-55008). It is available only to organizations enrolled in ESU.

  Check the newer update, KB5121575

  Exchange Server 2019 has reached end of support. ESU security updates are scheduled to end October 31, 2026.

  Key changes 11 CVEs · 1 change

  • Fix Exchange Server: Exchange Server receives fixes for security vulnerabilities, including a critical spoofing flaw.
  • Critical CVE-2026-55008: Microsoft Exchange Server Spoofing Vulnerability
  • CVSS 8.8 CVE-2026-45504: Microsoft Exchange Server Elevation of Privilege Vulnerability

  Read update → Source: Microsoft ↗

• Exchange Server 2016 CU23 Exchange Server 2016 CU23 ESU only Security update

  KB5103215 Jul 14, 2026

  Critical mail-server spoofing flaw addressed

  Resolves 11 vulnerabilities in Exchange Server 2016 CU23, including one critical spoofing vulnerability. It is available only to organizations enrolled in the Extended Security Update program.

  Check the newer update, KB5121576

  Exchange Server 2016 has reached end of support.

  Key changes 11 CVEs · 1 change

  • Fix Exchange Server: The update resolves security vulnerabilities in Exchange Server.
  • Critical CVE-2026-55008: Microsoft Exchange Server Spoofing Vulnerability
  • CVSS 8.8 CVE-2026-45504: Microsoft Exchange Server Elevation of Privilege Vulnerability

  Read update → Source: Microsoft ↗

• Exchange Server Subscription Edition RTM Exchange Server Subscription Edition RTM Security update

  Zero-day

  KB5094139 Jun 9, 2026

  Critical exploited spoofing flaw patched; mitigation services recover

  The update addresses Exchange vulnerabilities, including the actively exploited critical spoofing flaw CVE-2026-42897. It lists eight CVEs, but does not include the fix for CVE-2026-45583; follow that CVE’s guidance.

  Check the newer update, KB5103212

  Key changes 8 CVEs · 1 change

  • Fix Exchange mitigation and flighting services: Exchange mitigation and flighting services no longer fail with an “Unknown Issuer” error.
  • Exploited CVE-2026-42897: Microsoft Exchange Server Spoofing Vulnerability
  • Security CVE-2026-45500: Microsoft Exchange Server Spoofing Vulnerability

  Read update → Source: Microsoft ↗

• Exchange Server 2019 CU15 Exchange Server 2019 CU15 ESU only Security update

  Zero-day

  KB5094140 Jun 9, 2026

  Mail-server spoofing flaw patched; one remote-code flaw remains open

  The update closes Exchange Server vulnerabilities, including a critical spoofing flaw known to be exploited. It does not include a fix for CVE-2026-45583; follow that CVE’s documentation for instructions.

  Check the newer update, KB5103213

  Exchange Server 2019 has reached end of support. This update is for organizations in the ESU program, which provides security updates through October 31, 2026.

  Key changes 8 CVEs · 3 changes

  • Improved Exchange Server security: CVE-2026-45583, a remote code execution vulnerability, is not fixed by this update. Follow the instructions in the CVE documentation to...
  • Fix Exchange Server security: The update closes Exchange Server security vulnerabilities, including a critical spoofing flaw.
  • Fix Exchange mitigation and flighting services: Exchange mitigation and flighting services no longer fail with an “Unknown Issuer” error.

  Read update → Source: Microsoft ↗

• Exchange Server 2019 CU14 Exchange Server 2019 CU14 ESU only Security update

  Zero-day

  KB5094142 Jun 9, 2026

  Actively exploited spoofing flaw; mitigation services error fixed

  The update addresses seven of the eight listed vulnerabilities, including the critical, actively exploited Exchange spoofing flaw; it does not include the fix for CVE-2026-45583. It also fixes an “Unknown Issuer” error in mitigation and flighting services.

  Check the newer update, KB5103214

  Exchange Server 2019 is out of support. Only organizations enrolled in ESU can receive these updates, and ESU security updates for version 2019 end October 31, 2026.

  Key changes 8 CVEs · 1 change

  • Fix Exchange mitigation and flighting services: Exchange mitigation and flighting services no longer fail with an “Unknown Issuer” error.
  • Exploited CVE-2026-42897: Microsoft Exchange Server Spoofing Vulnerability
  • Security CVE-2026-45500: Microsoft Exchange Server Spoofing Vulnerability

  Read update → Source: Microsoft ↗

• Exchange Server 2016 CU23 Exchange Server 2016 CU23 ESU only Security update

  Zero-day

  KB5094144 Jun 9, 2026

  Exchange spoofing flaw exploited; mitigation services error fixed

  The update addresses Exchange Server vulnerabilities, including an actively exploited critical spoofing flaw. It does not include the fix for CVE-2026-45583.

  Check the newer update, KB5103215

  Exchange Server 2016 has reached end of support. Only organizations enrolled in ESU are eligible for its subsequent security updates, which end October 31, 2026.

  Key changes 8 CVEs · 2 changes

  • Fix Exchange Server: The update addresses Exchange Server vulnerabilities, but does not include the fix for CVE-2026-45583.
  • Fix Exchange mitigation and flighting services: The “Unknown Issuer” error that causes Exchange mitigation and flighting services to fail is fixed.
  • Exploited CVE-2026-42897: Microsoft Exchange Server Spoofing Vulnerability

  Read update → Source: Microsoft ↗