Skip to the content
The Update Bureau

Exchange Server 2016

Exchange Server 2016

Every published release for Exchange Server 2016, newest first: what each update changes, whether to install it and any confirmed known issues.

Latest
KB5128898 Oct 13, 2026
Build
15.1.2507.77
Released
Oct 1, 2015
Security updates (ESU)
no longer updated since Oct 31, 2026
Known issues
11 open

Latest update · Latest per branch (Branch)

Which branch am I on? →
  • CU23 Released Oct 13, 2026
    KB5128898 15.1.2507.77
  • CU14 Released Nov 27, 2024
    KB5049233 15.1.2507.44

Build history

  • Exchange Server 2016 CU23 Exchange Server 2016 CU23 ESU only Security update
    Final update for this version

    KB5128898

    Critical remote-code flaw and published-calendar errors addressed

    Fixes six Exchange Server vulnerabilities, including one critical remote-code-execution flaw, and resolves an issue that stopped published calendar subscriptions from refreshing. It is available only to organizations enrolled in the Extended Security Update program.

    Organizations enrolled in Period 2 ESU can receive Exchange Server 2016 security updates only through the end of October 2026.

    Key changes 6 CVEs · 2 changes

    • Fix Exchange Server: Exchange Server closes six security vulnerabilities, including a critical flaw that could allow remote code execution.
    • Fix Published calendars: Subscriptions to anonymously published calendars refresh again instead of stopping with an HTTP 500 error.
    • Critical CVE-2026-70571: Microsoft Exchange Server Remote Code Execution Vulnerability

    Read update Source: Microsoft

    Build
    15.1.2507.77
    Security
    6 fixed · 1 critical
  • Exchange Server 2016 CU23 Exchange Server 2016 CU23 ESU only Out-of-band security update
    Out-of-band

    KB5129958

    Shared mailbox wrapper messages fixed; published calendars can fail

    Fixes wrapper messages appearing in shared mailboxes in hybrid environments. Published calendar subscriptions can still return HTTP 500; KB5128898 later resolves the issue for Exchange Server 2016 CU23.

    Check the newer update, KB5128898
    Exchange Server 2016 is out of support. Period 2 ESU organizations can receive security updates through October 31, 2026.
    Known issues: 1 open Organizations and IT administrators
    • Published calendar (.ics) returns HTTP 500 for calendar applications

    Key changes 9 CVEs · 1 change

    • Fix Shared mailbox: In certain hybrid deployments, messages sent as or on behalf of a shared mailbox no longer also arrive in its Inbox as attachments with...
    • CVSS 8.8 CVE-2026-96940: Microsoft Exchange Server Elevation of Privilege Vulnerability
    • Security CVE-2026-55007: Microsoft Exchange Server Remote Code Execution Vulnerability

    Read update Source: Microsoft

    Build
    15.1.2507.75
    Security
    9 vulnerabilities fixed
  • Exchange Server 2016 CU23 Exchange Server 2016 CU23 ESU only Security update

    KB5121611

    Eight security flaws addressed; published calendar feeds can fail

    Addresses eight Important vulnerabilities and fixes wrapper messages appearing in shared mailboxes in hybrid deployments. Published calendar subscriptions can still return HTTP 500.

    Check the newer update, KB5129958
    Exchange Server 2016 has reached end of support. Only organizations enrolled in the Period 2 Extended Security Update program are eligible for security updates through the end of October 2026; organizations not enrolled should migrate to Exchange Server Subscription Edition.
    Known issues: 1 open Organizations and IT administrators
    • Published calendar (.ics) returns HTTP 500 for calendar applications

    Key changes 8 CVEs · 1 change

    • Fix Hybrid deployments: In certain hybrid deployments, messages sent as or on behalf of an Exchange Online shared mailbox no longer might also arrive in its In...
    • CVSS 9.3 CVE-2026-69356: Microsoft Exchange Server Spoofing Vulnerability
    • CVSS 9.1 CVE-2026-69641: Microsoft Exchange Server Elevation of Privilege Vulnerability

    Read update Source: Microsoft

    Build
    15.1.2507.73
    Security
    8 vulnerabilities fixed
  • Exchange Server 2016 CU23 Exchange Server 2016 CU23 ESU only Security update

    KB5121576

    Critical mailbox privilege flaw; shared-mailbox wrappers persist

    A critical elevation-of-privilege flaw in Exchange is fixed. Two known issues remain, including wrapper messages in shared mailboxes in hybrid setups.

    Check the newer update, KB5121611
    Only organizations enrolled in Period 2 ESU can receive security updates through the end of October 2026. Other organizations should migrate to Exchange Server Subscription Edition.
    Known issues: 2 open Organizations and IT administrators
    • Published calendar (.ics) returns HTTP 500 for calendar applications
    • Wrapper messages appear in shared mailbox in hybrid environments after installing the June 2026 Security Update

    Key security notes 7 CVEs

    • Critical CVE-2026-62911: Microsoft Exchange Server Elevation of Privilege Vulnerability
    • CVSS 8.8 CVE-2026-62913: Microsoft Exchange Server Remote Code Execution Vulnerability
    • CVSS 7.3 CVE-2026-62914: Microsoft Exchange Server Spoofing Vulnerability

    Read update Source: Microsoft

    Build
    15.1.2507.72
    Security
    7 fixed · 1 critical
  • Exchange Server 2016 CU23 Exchange Server 2016 CU23 ESU only Security update

    KB5103215

    Critical mail-server spoofing flaw addressed

    Resolves 11 vulnerabilities in Exchange Server 2016 CU23, including one critical spoofing vulnerability. It is available only to organizations enrolled in the Extended Security Update program.

    Check the newer update, KB5121576
    Exchange Server 2016 has reached end of support.

    Key changes 11 CVEs · 1 change

    • Fix Exchange Server: The update resolves security vulnerabilities in Exchange Server.
    • Critical CVE-2026-55008: Microsoft Exchange Server Spoofing Vulnerability
    • CVSS 8.8 CVE-2026-45504: Microsoft Exchange Server Elevation of Privilege Vulnerability

    Read update Source: Microsoft

    Build
    15.1.2507.71
    Security
    11 fixed · 1 critical
  • Exchange Server 2016 CU23 Exchange Server 2016 CU23 ESU only Security update
    Zero-day

    KB5094144

    Exchange spoofing flaw exploited; mitigation services error fixed

    The update addresses Exchange Server vulnerabilities, including an actively exploited critical spoofing flaw. It does not include the fix for CVE-2026-45583.

    Check the newer update, KB5103215
    Exchange Server 2016 has reached end of support. Only organizations enrolled in ESU are eligible for its subsequent security updates, which end October 31, 2026.

    Key changes 8 CVEs · 2 changes

    • Fix Exchange Server: The update addresses Exchange Server vulnerabilities, but does not include the fix for CVE-2026-45583.
    • Fix Exchange mitigation and flighting services: The “Unknown Issuer” error that causes Exchange mitigation and flighting services to fail is fixed.
    • Exploited CVE-2026-42897: Microsoft Exchange Server Spoofing Vulnerability

    Read update Source: Microsoft

    Build
    15.1.2507.69
    Security
    8 fixed · 1 critical · 1 exploited
  • Exchange Server 2016 CU23 Exchange Server 2016 CU23 ESU only Security update

    KB5074995

    Mail-server spoofing vulnerability addressed; ESU coverage ends in October

    Addresses an Important spoofing vulnerability in Exchange Server 2016. It is available only to organizations enrolled in the Extended Security Update program, which provides security updates through October 31, 2026.

    Check the newer update, KB5094144
    Exchange Server 2016 has reached end of support. ESU security updates are scheduled to continue through October 31, 2026.

    Key changes 1 CVE · 1 change

    • Fix Exchange Server: A spoofing vulnerability in Exchange Server is addressed.
    • CVSS 6.5 CVE-2026-21527: Microsoft Exchange Server Spoofing Vulnerability

    Read update Source: Microsoft

    Build
    15.1.2507.66
    Security
    1 vulnerability fixed
  • Exchange Server 2016 CU23 Exchange Server 2016 CU23 ESU only Security update

    KB5071873

    Privilege escalation and spoofing flaws addressed

    Resolves two important security flaws: one could give an attacker more access, and the other could let an attacker fake an identity.

    Check the newer update, KB5074995
    ESU security updates for Exchange Server 2016 are scheduled to end October 31, 2026.

    Key changes 2 CVEs · 2 changes

    • Fix Exchange Server: A flaw that could give an attacker more access is fixed.
    • Fix Exchange Server: A flaw that could let an attacker fake an identity is fixed.
    • CVSS 7.5 CVE-2025-64666: Microsoft Exchange Server Elevation of Privilege Vulnerability

    Read update Source: Microsoft

    Build
    15.1.2507.63
    Security
    2 vulnerabilities fixed
  • Exchange Server 2016 CU23 Exchange Server 2016 CU23 ESU only Security update

    KB5066369

    Three vulnerabilities addressed; Auth Certificate export issue fixed

    The update addresses three Exchange Server vulnerabilities and an Auth Certificate export issue. It is available only to organizations in the Extended Security Update program.

    Check the newer update, KB5071873

    Key changes 3 CVEs · 1 change

    • Fix Auth Certificate export: The Auth Certificate export issue involving an Exchange cmdlet is addressed; export through that cmdlet is no longer supported.
    • CVSS 8.8 CVE-2025-59249: Microsoft Exchange Server Elevation of Privilege Vulnerability
    • CVSS 8.4 CVE-2025-53782: Microsoft Exchange Server Elevation of Privilege Vulnerability

    Read update Source: Microsoft

    Build
    15.1.2507.61
    Security
    3 vulnerabilities fixed
  • Exchange Server 2016 CU23 Exchange Server 2016 CU23 ESU only Hotfix update

    KB5066370

    Hybrid online archiving resumes for on-premises mailboxes

    Restores automatic online archiving for some on-premises mailboxes in hybrid environments. This update is available only to organizations enrolled in Extended Security Updates.

    Check the newer update, KB5066369

    Key changes 1 change

    • Fix Online archiving: Items configured to move to an online archive are moved automatically again for affected on-premises users in hybrid environments.

    Read update Source: Microsoft

    Build
    15.1.2507.59
  • Exchange Server 2016 CU23 Exchange Server 2016 CU23 ESU only Security update

    KB5063223

    eDiscovery export failures fixed alongside four vulnerabilities

    The update addresses four Important vulnerabilities and fixes failures with eDiscovery exports, application pools, and public folder management in Outlook.

    Check the newer update, KB5066370

    Key changes 4 CVEs · 3 changes

    • Fix eDiscovery search results: eDiscovery search results can be exported to a discovery mailbox again.
    • Fix Application pools: Application pools no longer stop responding and affect performance after MSIPC is enabled.
    • Fix Public folder management in Outlook: Public folder management in Outlook modifies the correct ACE instead of an incorrect one.

    Read update Source: Microsoft

    Build
    15.1.2507.58
    Security
    4 vulnerabilities fixed
  • Exchange Server 2016 CU23 Exchange Server 2016 CU23 ESU only Hotfix update

    KB5057653

    Journal delivery, calendar printing and mailbox quarantine issues fixed

    This hotfix addresses four Exchange issues, including journal messages stuck in submission and mailboxes quarantined after a background process stops responding. It is for organizations enrolled in the Extended Security Update program.

    Check the newer update, KB5063223
    Exchange Online is retiring access through Outlook on the web to an online archive for users whose primary mailbox is on-premises. The notice does not specify an action to take.

    Key changes 4 changes

    • Fix Journal messages: Journal messages that fail during content conversion can get stuck in the submission queue; this hotfix fixes the issue.
    • Fix Outlook on the web: The listed calendar-printing issue covers Exchange Server 2019 CU14 after its March 2024 security update: selecting Print produces no p...
    • Fix Edge Transport service: The Edge Transport service can stop responding and restart while handling certain externally protected messages; this hotfix fixes the...

    Read update Source: Microsoft

    Build
    15.1.2507.57
  • Exchange Server 2016 CU23 Exchange Server 2016 CU23 ESU only Hotfix update

    KB5050674

    Fixes 1 vulnerability

    This hotfix for Exchange Server 2016 CU23 addresses one Important-severity vulnerability. It is available only to organizations in the Extended Security Update program.

    Check the newer update, KB5057653

    Key security notes 1 CVE

    • CVSS 8.0 CVE-2025-53786: Microsoft Exchange Server Hybrid Deployment Elevation of Privilege Vulnerability

    Read update Source: Microsoft

    Build
    15.1.2507.55
    Security
    1 vulnerability fixed
  • Exchange Server 2016 / 2019 CU14 Exchange Server 2016 / 2019 CU14 ESU only Out-of-band security update
    Out-of-band

    KB5049233

    Transport and DLP rules work again after the earlier update

    Exchange Transport Rules and Data Loss Prevention rules work again after the earlier November update. The rerelease also addresses a publicly disclosed Exchange Server vulnerability.

    Check the newer update, KB5050673
    Known issues: 3 open Organizations and IT administrators
    • A time zone exception occurs after installing Exchange Server November 2024 SU (Version 1 or Version 2)
    • The Edge Transport service stops responding after installing November 2024 SU
    • A file version error occurs when you try to install Exchange Server November 2024 SU

    Key changes 1 CVE · 14 changes

    • New MSIPC: MSIPC is enabled by default in Exchange Server 2019 and 2016.
    • New AMSI: AMSI integration adds support for scanning message bodies.
    • New P2 FROM header detection: Exchange can detect P2 FROM headers that do not follow the RFC standard.

    Read update Source: Microsoft

    Builds
    15.1.2507.44 · 15.2.1258.39 · 15.2.1544.14
    Security
    1 vulnerability fixed
  • Exchange Server 2016 / 2019 CU14 Exchange Server 2016 / 2019 CU14 ESU only Security update

    KB5044062

    Transport rules can stop processing; Edge Transport can hang

    Exchange Transport Rules and DLP rules can stop processing after version 1, while Edge Transport can stop responding. The update addresses CVE-2024-49040; KB5049233 is the re-released version.

    Check the newer update, KB5049233
    Known issues: 4 open Organizations and IT administrators
    • Exchange Transport Rules and Data Loss Prevention rules don't work after installing November 2024 SU V1
    • A time zone exception occurs after installing Exchange Server November 2024 SU (Version 1 or Version 2)
    • and 2 more

    Key changes 1 CVE · 14 changes

    • New MSIPC: MSIPC is enabled by default in Exchange Server 2019 and 2016.
    • New AMSI: AMSI integration adds support for scanning message bodies.
    • New P2 FROM header: Exchange detects P2 FROM headers that do not follow RFC rules.

    Read update Source: Microsoft

    Builds
    15.1.2507.43 · 15.2.1258.38 · 15.2.1544.13
    Security
    1 vulnerability fixed
  • Exchange Server 2016 / 2019 CU14 Exchange Server 2016 / 2019 CU14 ESU only Hotfix update

    KB5037224

    ECC certificates added; CU14 adds HMA for OWA and ECP

    Adds Elliptic Curve Cryptography certificate support to Exchange 2016 and 2019, and Hybrid Modern Authentication for OWA and ECP on Exchange 2019 CU14. It also includes one Important security fix and resolves seven listed issues.

    Check the newer update, KB5044062

    Key changes 1 CVE · 9 changes

    • New Elliptic Curve Cryptography certificates: Exchange Server 2016 and 2019 support Elliptic Curve Cryptography certificates.
    • New Hybrid Modern Authentication: Exchange Server 2019 CU14 supports Hybrid Modern Authentication for OWA and ECP.
    • Fix OWA: The “We can't open this document” error in OWA after installing the March 2024 security update is fixed.

    Read update Source: Microsoft

    Builds
    15.1.2507.39 · 15.2.1258.34 · 15.2.1544.11
    Security
    1 vulnerability fixed
  • Exchange Server 2016 CU23 Exchange Server 2016 CU23 ESU only Security update
    Zero-day

    KB5036386

    Exploited Exchange privilege flaw patched; attachment text scanning removed

    An exploited Exchange privilege flaw is patched, while attachment text extraction for some file types is removed. Several Outlook and OWA problems also need a later hotfix.

    Check the newer update, KB5037224
    Known issues: 5 open Organizations and IT administrators
    • After you install this security update (SU), the program no longer supports the Oracle Outside In Technology (OIT) or OutsideInModule.
    • After you install this SU, Download Domains are no longer working as expected.
    • and 3 more

    Key changes 2 CVEs · 2 changes

    • Fix EWS search: EWS searches no longer show inaccurate results.
    • Removed Attachment text extraction: Exchange no longer extracts text from JPEG, TIFF, or AutoCAD attachments for mail-flow checks. Attachment rules might not inspect their...
    • Exploited CVE-2024-21410: Microsoft Exchange Server Elevation of Privilege Vulnerability

    Read update Source: Microsoft

    Build
    15.1.2507.37
    Security
    2 fixed · 1 critical · 1 exploited