Skip to the content
The Update Bureau

Exchange Server 2019

Exchange Server 2019

Every published release for Exchange Server 2019, newest first: what each update changes, whether to install it and any confirmed known issues.

Latest
KB5128896 Oct 13, 2026
Build
15.2.1748.55
Released
Oct 22, 2018
Security updates (ESU)
no longer updated since Oct 31, 2026
Known issues
11 open

Latest update · Latest per branch (Branch)

Which branch am I on? →
  • CU15 Released Oct 13, 2026
    KB5128896 15.2.1748.55
  • CU14 Released Oct 13, 2026
    KB5128897 15.2.1544.50
  • CU13 Released Mar 12, 2024
    KB5036402 15.2.1258.32

Build history

  • Exchange Server 2019 CU15 Exchange Server 2019 CU15 ESU only Security update
    Final update for this version

    KB5128896

    Critical remote-code flaw patched; calendar feeds restored

    Fixes a critical Exchange Server remote-code execution vulnerability and restores published calendar subscriptions that returned HTTP 500 errors.

    Exchange Server 2019 ESU security updates end on October 31, 2026. Only organizations enrolled in the Period 2 ESU program are eligible for this update.

    Key changes 6 CVEs · 2 changes

    • Fix Security: Exchange Server is protected against six security vulnerabilities, including a critical flaw that could allow remote code execution.
    • Fix Published calendars: Subscriptions to published calendars work again instead of returning HTTP 500 errors.
    • Critical CVE-2026-70571: Microsoft Exchange Server Remote Code Execution Vulnerability

    Read update Source: Microsoft

    Build
    15.2.1748.55
    Security
    6 fixed · 1 critical
  • Exchange Server 2019 CU14 Exchange Server 2019 CU14 ESU only Security update
    Final update for this version

    KB5128897

    Remote-code-execution flaw patched; published calendar errors fixed

    Addresses six Exchange Server vulnerabilities, including one critical flaw, and resolves HTTP 500 errors affecting published calendar subscriptions. It is available only to organizations enrolled in the Extended Security Update program.

    Exchange Server 2019 has reached end of support. Organizations not enrolled in ESU should migrate to Exchange Server Subscription Edition to continue receiving security updates.

    Key changes 6 CVEs · 2 changes

    • Fix Exchange Server: The update addresses six security vulnerabilities, including one critical remote-code-execution flaw.
    • Fix Published calendars (.ics): Published calendar subscriptions that return HTTP 500 are resolved by this update.
    • Critical CVE-2026-70571: Microsoft Exchange Server Remote Code Execution Vulnerability

    Read update Source: Microsoft

    Build
    15.2.1544.50
    Security
    6 fixed · 1 critical
  • Exchange Server 2019 CU15 Exchange Server 2019 CU15 ESU only Out-of-band security update
    Out-of-band

    KB5129956

    Published calendar feeds can fail with HTTP 500

    Addresses 9 vulnerabilities in Exchange Server 2019 CU15. A known issue can stop published calendar subscriptions from refreshing and return HTTP 500; an IIS workaround is available.

    Check the newer update, KB5128896
    Exchange Server 2019 has reached end of support. Period 2 ESU organizations can receive security updates only through the end of October 2026.
    Known issues: 1 open Organizations and IT administrators
    • Published calendar (.ics) returns HTTP 500 for calendar applications

    Key changes 9 CVEs · 1 change

    • Fix Hybrid shared mailboxes: In hybrid setups, messages sent as or on behalf of a shared mailbox no longer also arrive in its Inbox as wrapper attachments.
    • CVSS 8.8 CVE-2026-96940: Microsoft Exchange Server Elevation of Privilege Vulnerability
    • Security CVE-2026-55007: Microsoft Exchange Server Remote Code Execution Vulnerability

    Read update Source: Microsoft

    Build
    15.2.1748.53
    Security
    9 vulnerabilities fixed
  • Exchange Server 2019 CU14 Exchange Server 2019 CU14 ESU only Out-of-band security update
    Out-of-band

    KB5129957

    Hybrid shared-mailbox wrapper messages fixed; calendar feeds may fail

    Fixes a hybrid shared-mailbox message issue and addresses 9 vulnerabilities. It is available only to organizations in the Period 2 ESU program; published calendar feeds can still return HTTP 500.

    Check the newer update, KB5128897
    Period 2 ESU organizations are eligible for Exchange Server 2019 security updates through the end of October 2026. Organizations not enrolled should migrate to Exchange Server Subscription Edition to continue receiving the latest security updates.
    Known issues: 1 open Organizations and IT administrators
    • Published calendar (.ics) returns HTTP 500 for calendar applications

    Key changes 9 CVEs · 1 change

    • Fix Shared mailbox: In a hybrid deployment, messages sent as or on behalf of a shared mailbox hosted in Exchange Online no longer also appear in that mailb...
    • CVSS 8.8 CVE-2026-96940: Microsoft Exchange Server Elevation of Privilege Vulnerability
    • Security CVE-2026-55007: Microsoft Exchange Server Remote Code Execution Vulnerability

    Read update Source: Microsoft

    Build
    15.2.1544.48
    Security
    9 vulnerabilities fixed
  • Exchange Server 2019 CU15 Exchange Server 2019 CU15 ESU only Security update

    KB5121609

    Published calendar feeds can fail; hybrid sent-mail copies fixed

    Security vulnerabilities are addressed, and a hybrid shared-mailbox message-copy problem is fixed. Published calendar subscriptions can still return HTTP 500; a workaround is available.

    Check the newer update, KB5129956
    Exchange Server 2019 has reached end of support. Period 2 ESU organizations can receive security updates until the end of October 2026.
    Known issues: 1 open Organizations and IT administrators
    • Published calendar (.ics) returns HTTP 500 for calendar applications

    Key changes 9 CVEs · 2 changes

    • Fix Security: Security vulnerabilities in the server are addressed.
    • Fix Shared mailboxes: In some hybrid setups, sent-as or sent-on-behalf messages no longer also appear as attachments in a shared mailbox's Inbox.
    • CVSS 9.3 CVE-2026-69356: Microsoft Exchange Server Spoofing Vulnerability

    Read update Source: Microsoft

    Build
    15.2.1748.51
    Security
    9 vulnerabilities fixed
  • Exchange Server 2019 CU14 Exchange Server 2019 CU14 ESU only Security update

    KB5121610

    Exchange security flaws addressed; hybrid mailbox wrappers fixed

    Security flaws are addressed, and a hybrid shared-mailbox message issue is fixed under specific mailbox and permission settings. Published calendar subscriptions stop refreshing and return HTTP 500 errors.

    Check the newer update, KB5129957
    Exchange Server 2019 is out of support. Period 2 ESU organizations can receive security updates through October 31, 2026.
    Known issues: 1 open Organizations and IT administrators
    • Published calendar (.ics) returns HTTP 500 for calendar applications

    Key changes 9 CVEs · 2 changes

    • Fix Exchange Server: Security flaws in Exchange Server are addressed.
    • Fix Shared mailboxes: In hybrid setups, sent-as or sent-on-behalf messages may also reach a shared mailbox as wrapper attachments. The shared mailbox is in E...
    • CVSS 9.3 CVE-2026-69356: Microsoft Exchange Server Spoofing Vulnerability

    Read update Source: Microsoft

    Build
    15.2.1544.46
    Security
    9 vulnerabilities fixed
  • Exchange Server 2019 CU15 Exchange Server 2019 CU15 ESU only Security update

    KB5121574

    Critical privilege-escalation flaw in the mail server addressed

    A critical flaw could let attackers gain higher privileges on the mail server. Only organizations enrolled in the Extended Security Update program can receive this release.

    Check the newer update, KB5121609
    Period 2 ESU organizations can receive security updates through the end of October 2026.
    Known issues: 2 open Organizations and IT administrators
    • Published calendar (.ics) returns HTTP 500 for calendar applications
    • Wrapper messages appear in shared mailbox in hybrid environments after installing the June 2026 Security Update

    Key changes 7 CVEs · 1 change

    • Fix Exchange Server: A critical flaw could let attackers gain higher privileges on the mail server.
    • Critical CVE-2026-62911: Microsoft Exchange Server Elevation of Privilege Vulnerability
    • CVSS 8.8 CVE-2026-62913: Microsoft Exchange Server Remote Code Execution Vulnerability

    Read update Source: Microsoft

    Build
    15.2.1748.49
    Security
    7 fixed · 1 critical
  • Exchange Server 2019 CU14 Exchange Server 2019 CU14 ESU only Security update

    KB5121575

    Critical Exchange privilege flaw covered; CU14 ESU ends in October

    A critical Exchange privilege flaw is addressed. CU14 security updates are available only to ESU organizations through October 31, 2026.

    Check the newer update, KB5121610
    Exchange Server 2019 has reached end of support. ESU security updates are available to enrolled organizations through October 2026.
    Known issues: 2 open Organizations and IT administrators
    • Published calendar (.ics) returns HTTP 500 for calendar applications
    • Wrapper messages appear in shared mailbox in hybrid environments after installing the June 2026 Security Update

    Key changes 7 CVEs · 1 change

    • Fix Exchange Server: The update addresses vulnerabilities in Exchange Server.
    • Critical CVE-2026-62911: Microsoft Exchange Server Elevation of Privilege Vulnerability
    • CVSS 8.8 CVE-2026-62913: Microsoft Exchange Server Remote Code Execution Vulnerability

    Read update Source: Microsoft

    Build
    15.2.1544.44
    Security
    7 fixed · 1 critical
  • Exchange Server 2019 CU15 Exchange Server 2019 CU15 ESU only Security update

    KB5103213

    Mail-server spoofing, code-execution and privilege flaws addressed

    Addresses 11 vulnerabilities in Exchange Server, including one Critical flaw. It is available only to organizations enrolled in the Extended Security Update program.

    Check the newer update, KB5121574
    Extended Security Updates for Exchange Server 2019 end on October 31, 2026.

    Key changes 11 CVEs · 4 changes

    • Fix Exchange Server: Closes a remote code execution vulnerability in Exchange Server.
    • Fix Exchange Server: Closes an elevation of privilege vulnerability in Exchange Server.
    • Fix Exchange Server: Closes a spoofing vulnerability in Exchange Server.

    Read update Source: Microsoft

    Build
    15.2.1748.48
    Security
    11 fixed · 1 critical
  • Exchange Server 2019 CU14 Exchange Server 2019 CU14 ESU only Security update

    KB5103214

    Critical mail-server spoofing flaw addressed

    Addresses 11 vulnerabilities in Exchange Server 2019 CU14, including one critical spoofing flaw (CVE-2026-55008). It is available only to organizations enrolled in ESU.

    Check the newer update, KB5121575
    Exchange Server 2019 has reached end of support. ESU security updates are scheduled to end October 31, 2026.

    Key changes 11 CVEs · 1 change

    • Fix Exchange Server: Exchange Server receives fixes for security vulnerabilities, including a critical spoofing flaw.
    • Critical CVE-2026-55008: Microsoft Exchange Server Spoofing Vulnerability
    • CVSS 8.8 CVE-2026-45504: Microsoft Exchange Server Elevation of Privilege Vulnerability

    Read update Source: Microsoft

    Build
    15.2.1544.43
    Security
    11 fixed · 1 critical
  • Exchange Server 2019 CU15 Exchange Server 2019 CU15 ESU only Security update
    Zero-day

    KB5094140

    Mail-server spoofing flaw patched; one remote-code flaw remains open

    The update closes Exchange Server vulnerabilities, including a critical spoofing flaw known to be exploited. It does not include a fix for CVE-2026-45583; follow that CVE’s documentation for instructions.

    Check the newer update, KB5103213
    Exchange Server 2019 has reached end of support. This update is for organizations in the ESU program, which provides security updates through October 31, 2026.

    Key changes 8 CVEs · 3 changes

    • Improved Exchange Server security: CVE-2026-45583, a remote code execution vulnerability, is not fixed by this update. Follow the instructions in the CVE documentation to...
    • Fix Exchange Server security: The update closes Exchange Server security vulnerabilities, including a critical spoofing flaw.
    • Fix Exchange mitigation and flighting services: Exchange mitigation and flighting services no longer fail with an “Unknown Issuer” error.

    Read update Source: Microsoft

    Build
    15.2.1748.46
    Security
    8 fixed · 1 critical · 1 exploited
  • Exchange Server 2019 CU14 Exchange Server 2019 CU14 ESU only Security update
    Zero-day

    KB5094142

    Actively exploited spoofing flaw; mitigation services error fixed

    The update addresses seven of the eight listed vulnerabilities, including the critical, actively exploited Exchange spoofing flaw; it does not include the fix for CVE-2026-45583. It also fixes an “Unknown Issuer” error in mitigation and flighting services.

    Check the newer update, KB5103214
    Exchange Server 2019 is out of support. Only organizations enrolled in ESU can receive these updates, and ESU security updates for version 2019 end October 31, 2026.

    Key changes 8 CVEs · 1 change

    • Fix Exchange mitigation and flighting services: Exchange mitigation and flighting services no longer fail with an “Unknown Issuer” error.
    • Exploited CVE-2026-42897: Microsoft Exchange Server Spoofing Vulnerability
    • Security CVE-2026-45500: Microsoft Exchange Server Spoofing Vulnerability

    Read update Source: Microsoft

    Build
    15.2.1544.41
    Security
    8 fixed · 1 critical · 1 exploited
  • Exchange Server 2019 CU15 Exchange Server 2019 CU15 ESU only Security update

    KB5074993

    Mail-server spoofing flaw addressed; ESU enrollment required

    The update resolves CVE-2026-21527, an Exchange Server spoofing vulnerability. Only organizations enrolled in the Extended Security Update program are eligible to receive it.

    Check the newer update, KB5094140
    Exchange Server 2019 is out of support. ESU security updates are scheduled to end October 31, 2026.

    Key changes 1 CVE · 1 change

    • Fix Exchange Server: The Exchange Server spoofing vulnerability CVE-2026-21527 is resolved.
    • CVSS 6.5 CVE-2026-21527: Microsoft Exchange Server Spoofing Vulnerability

    Read update Source: Microsoft

    Build
    15.2.1748.43
    Security
    1 vulnerability fixed
  • Exchange Server 2019 CU14 Exchange Server 2019 CU14 ESU only Security update

    KB5074994

    Spoofing flaw needs a separate mitigation step

    The update addresses a spoofing vulnerability in Exchange Server, but the CVE bulletin's mitigation instructions are also needed. Only organizations enrolled in the Extended Security Update program are eligible.

    Check the newer update, KB5094142
    Exchange Server 2019 has reached end of support. ESU security updates for version 2019 end October 31, 2026; only enrolled organizations are eligible for these updates.

    Key changes 1 CVE · 2 changes

    • Improved Update replacement: This update replaces the December 9, 2025 security update, KB5071874.
    • Fix Microsoft Exchange Server: The update resolves a spoofing vulnerability, but mitigating it also requires following the instructions in the CVE bulletin.
    • CVSS 6.5 CVE-2026-21527: Microsoft Exchange Server Spoofing Vulnerability

    Read update Source: Microsoft

    Build
    15.2.1544.39
    Security
    1 vulnerability fixed
  • Exchange Server 2019 CU15 Exchange Server 2019 CU15 ESU only Security update

    KB5071875

    Mail-server elevation-of-privilege and spoofing flaws patched

    The update resolves two Exchange Server 2019 CU15 security vulnerabilities: an elevation-of-privilege flaw and a spoofing flaw. Only organizations enrolled in the Extended Security Update program are eligible.

    Check the newer update, KB5074993
    Exchange Server 2019 has reached end of support. Organizations enrolled in ESU can receive security updates through October 31, 2026.

    Key changes 2 CVEs · 1 change

    • Fix Exchange Server: The update resolves an elevation-of-privilege vulnerability and a spoofing vulnerability in Exchange Server.
    • CVSS 7.5 CVE-2025-64666: Microsoft Exchange Server Elevation of Privilege Vulnerability
    • CVSS 5.3 CVE-2025-64667: Microsoft Exchange Server Spoofing Vulnerability

    Read update Source: Microsoft

    Build
    15.2.1748.42
    Security
    2 vulnerabilities fixed
  • Exchange Server 2019 CU14 Exchange Server 2019 CU14 ESU only Security update

    KB5071874

    Exchange privilege escalation and spoofing flaws addressed

    Addresses two important Exchange Server vulnerabilities: one involving privilege escalation and one involving spoofing. Only organizations enrolled in the Extended Security Update program are eligible.

    Check the newer update, KB5074994
    Exchange Server 2019 has reached end of support. Only organizations enrolled in the Extended Security Update program are eligible for these and subsequent security updates.

    Key changes 2 CVEs · 2 changes

    • Fix Exchange Server: An Exchange Server elevation-of-privilege vulnerability is addressed.
    • Fix Exchange Server: An Exchange Server spoofing vulnerability is addressed.
    • CVSS 7.5 CVE-2025-64666: Microsoft Exchange Server Elevation of Privilege Vulnerability

    Read update Source: Microsoft

    Build
    15.2.1544.37
    Security
    2 vulnerabilities fixed
  • Exchange Server 2019 CU15 Exchange Server 2019 CU15 ESU only Security update

    KB5066367

    Three vulnerabilities fixed; Auth Certificate export no longer supported

    The update fixes three important vulnerabilities and makes Auth Certificate export through an Exchange cmdlet no longer supported.

    Check the newer update, KB5071875
    Exchange Server 2019 ESU security updates end on October 31, 2026.

    Key changes 3 CVEs · 2 changes

    • Fix Security: The update fixes three vulnerabilities in Exchange Server.
    • Removed Auth Certificate export: Exporting the Auth Certificate through an Exchange cmdlet is no longer supported.
    • CVSS 8.8 CVE-2025-59249: Microsoft Exchange Server Elevation of Privilege Vulnerability

    Read update Source: Microsoft

    Build
    15.2.1748.39
    Security
    3 vulnerabilities fixed
  • Exchange Server 2019 CU14 Exchange Server 2019 CU14 ESU only Security update

    KB5066368

    Exchange vulnerabilities patched; Auth Certificate export ends

    Fixes three Important Exchange Server vulnerabilities and removes Auth Certificate export through an Exchange cmdlet. It is available only to organizations in the Extended Security Update program.

    Check the newer update, KB5071874
    Exchange Server 2019 ESU security updates are scheduled to end on October 31, 2026.

    Key changes 3 CVEs · 2 changes

    • Fix Exchange Server: The update fixes three security vulnerabilities in Exchange Server.
    • Removed Exchange cmdlets: Auth Certificate export through an Exchange cmdlet is no longer supported.
    • CVSS 8.8 CVE-2025-59249: Microsoft Exchange Server Elevation of Privilege Vulnerability

    Read update Source: Microsoft

    Build
    15.2.1544.36
    Security
    3 vulnerabilities fixed
  • Exchange Server 2019 CU15 Exchange Server 2019 CU15 ESU only Hotfix update

    KB5066372

    Hybrid online archiving resumes automatic moves to archive

    Automatic moves to Exchange Online archives work again for on-premises mailboxes in a hybrid setup using the dedicated Exchange Hybrid Application feature.

    Check the newer update, KB5066367

    Key changes 1 change

    • Fix Online archiving: Items tagged to move to an online archive are automatically moved again for on-premises users in a hybrid setup.

    Read update Source: Microsoft

    Build
    15.2.1748.37
  • Exchange Server 2019 CU14 Exchange Server 2019 CU14 ESU only Hotfix update

    KB5066371

    Automatic online archiving works again in hybrid environments

    This hotfix restores automatic movement of archive-tagged items to Exchange Online archives when the primary mailbox is on-premises in a hybrid environment.

    Check the newer update, KB5066368

    Key changes 1 change

    • Fix Online archiving: Items tagged to move to an online archive are automatically moved again when the primary mailbox is on-premises in a hybrid environment...

    Read update Source: Microsoft

    Build
    15.2.1544.34
  • Exchange Server 2019 CU15 Exchange Server 2019 CU15 ESU only Security update

    KB5063221

    Four vulnerabilities addressed; eDiscovery and app-pool issues fixed

    The update addresses four Important vulnerabilities and fixes eDiscovery exports, unresponsive application pools after MSIPC is enabled, and incorrect ACE changes through Outlook public-folder management.

    Check the newer update, KB5066372

    Key changes 4 CVEs · 3 changes

    • Fix eDiscovery: eDiscovery search results can be exported to a discovery mailbox again.
    • Fix Application pools: Application pools no longer stop responding and affect performance after MSIPC is enabled.
    • Fix Public folder management: Outlook no longer modifies the incorrect ACE through public folder management.

    Read update Source: Microsoft

    Build
    15.2.1748.36
    Security
    4 vulnerabilities fixed
  • Exchange Server 2019 CU14 Exchange Server 2019 CU14 ESU only Security update

    KB5063222

    Four server flaws addressed; eDiscovery exports restored

    The update addresses four Important vulnerabilities and fixes eDiscovery export problems. It is available only to organizations in the Extended Security Update program.

    Check the newer update, KB5066371

    Key changes 4 CVEs · 4 changes

    • Improved Security update replacement: This update replaces KB5049233.
    • Fix eDiscovery: eDiscovery search results can be exported to a discovery mailbox again.
    • Fix Application pools: Application pools no longer stop responding and affect performance after MSIPC is enabled.

    Read update Source: Microsoft

    Build
    15.2.1544.33
    Security
    4 vulnerabilities fixed
  • Exchange Server 2019 CU15 Exchange Server 2019 CU15 ESU only Hotfix update

    KB5057651

    Edge Transport stalls and StoreWorker failures fixed

    This optional hotfix fixes four Exchange Server 2019 issues, including Edge Transport service failures and StoreWorker problems that can quarantine mailboxes. It also includes the November 2024 security updates.

    Check the newer update, KB5063221
    Exchange Online is retiring access to cloud archive mailboxes through OWA for users whose primary mailbox is on-premises. The page does not specify an action to take.

    Key changes 4 changes

    • Fix Journal messages: Fixes the journal message issue that returns “ConversionFailedException.”
    • Fix Calendar printing in OWA: Fixes the issue that prevents calendar printing in Outlook on the web.
    • Fix Edge Transport service: Fixes the issue that makes the Edge Transport service stop responding after certain updates.

    Read update Source: Microsoft

    Build
    15.2.1748.26
  • Exchange Server 2019 CU14 Exchange Server 2019 CU14 ESU only Hotfix update

    KB5057652

    Azure RMS transport failures and quarantined mailboxes addressed

    This hotfix fixes OWA calendar printing, journal-message conversion errors, StoreWorker failures that can quarantine mailboxes, and Edge Transport crashes when decrypting externally sent Azure RMS-protected messages. It also retires OWA access to Exchange Online archives for people with on-premises primary mailboxes.

    Check the newer update, KB5063222
    Exchange Online is retiring OWA access to archive mailboxes for people whose primary mailbox is hosted on-premises. The announcement gives no action to take.

    Key changes 5 changes

    • Fix Journal messages: Journal messages no longer get stuck in the submission queue with a ConversionFailedException.
    • Fix Calendar printing in OWA: Printing a calendar from OWA works again instead of producing no print job on screen.
    • Fix Edge Transport service: The Edge Transport service no longer stops responding and restarting when Exchange Server decrypts externally sent messages protected b...

    Read update Source: Microsoft

    Build
    15.2.1544.27
  • Exchange Server 2019 CU15 Exchange Server 2019 CU15 ESU only Hotfix update

    KB5050672

    An important mail-server vulnerability addressed

    This hotfix addresses one important security vulnerability in Exchange Server 2019 CU15. It is available only to organizations enrolled in the Extended Security Update program.

    Check the newer update, KB5057651

    Key security notes 1 CVE

    • CVSS 8.0 CVE-2025-53786: Microsoft Exchange Server Hybrid Deployment Elevation of Privilege Vulnerability

    Read update Source: Microsoft

    Build
    15.2.1748.24
    Security
    1 vulnerability fixed