Skip to the content
The Update Bureau

Exchange Server

Exchange Server updates

All published releases for Exchange Server, newest first: what each update changes, whether to install it and any confirmed known issues. Latest release: November 10, 2026.

13 active known issues →

Exchange Server updates

  • Exchange Server Subscription Edition RTM Exchange Server Subscription Edition RTM Hotfix update

    KB5081755

    Microsoft Graph adds hybrid free/busy and profile sharing

    Exchange Server SE RTM gains Microsoft Graph support for hybrid free/busy and profile picture sharing, plus partial MailTips support. The change replaces EWS in most hybrid scenarios ahead of its scheduled retirement from Exchange Online in October 2026.

    Check the newer update, KB5094139
    EWS is scheduled to retire from Exchange Online in October 2026; this change replaces its use in most hybrid scenarios.

    Key changes 1 change

    • New Microsoft Graph: Hybrid deployments can use Microsoft Graph for free/busy information and profile picture sharing, and for MailTips in some cases.

    Read update Source: Microsoft

    Build
    15.2.2562.41
  • Exchange Server Subscription Edition RTM Exchange Server Subscription Edition RTM Security update

    KB5074992

    Spoofing vulnerability in Exchange addressed

    Resolves CVE-2026-21527, a spoofing vulnerability in Exchange Server.

    Check the newer update, KB5081755

    Key changes 1 CVE · 1 change

    • Fix Exchange Server: The update resolves a spoofing vulnerability in Exchange Server.
    • CVSS 6.5 CVE-2026-21527: Microsoft Exchange Server Spoofing Vulnerability

    Read update Source: Microsoft

    Build
    15.2.2562.37
    Security
    1 vulnerability fixed
    Restart
    Required
  • Exchange Server 2019 CU15 Exchange Server 2019 CU15 ESU only Security update

    KB5074993

    Mail-server spoofing flaw addressed; ESU enrollment required

    The update resolves CVE-2026-21527, an Exchange Server spoofing vulnerability. Only organizations enrolled in the Extended Security Update program are eligible to receive it.

    Check the newer update, KB5094140
    Exchange Server 2019 is out of support. ESU security updates are scheduled to end October 31, 2026.

    Key changes 1 CVE · 1 change

    • Fix Exchange Server: The Exchange Server spoofing vulnerability CVE-2026-21527 is resolved.
    • CVSS 6.5 CVE-2026-21527: Microsoft Exchange Server Spoofing Vulnerability

    Read update Source: Microsoft

    Build
    15.2.1748.43
    Security
    1 vulnerability fixed
  • Exchange Server 2019 CU14 Exchange Server 2019 CU14 ESU only Security update

    KB5074994

    Spoofing flaw needs a separate mitigation step

    The update addresses a spoofing vulnerability in Exchange Server, but the CVE bulletin's mitigation instructions are also needed. Only organizations enrolled in the Extended Security Update program are eligible.

    Check the newer update, KB5094142
    Exchange Server 2019 has reached end of support. ESU security updates for version 2019 end October 31, 2026; only enrolled organizations are eligible for these updates.

    Key changes 1 CVE · 2 changes

    • Improved Update replacement: This update replaces the December 9, 2025 security update, KB5071874.
    • Fix Microsoft Exchange Server: The update resolves a spoofing vulnerability, but mitigating it also requires following the instructions in the CVE bulletin.
    • CVSS 6.5 CVE-2026-21527: Microsoft Exchange Server Spoofing Vulnerability

    Read update Source: Microsoft

    Build
    15.2.1544.39
    Security
    1 vulnerability fixed
  • Exchange Server 2016 CU23 Exchange Server 2016 CU23 ESU only Security update

    KB5074995

    Mail-server spoofing vulnerability addressed; ESU coverage ends in October

    Addresses an Important spoofing vulnerability in Exchange Server 2016. It is available only to organizations enrolled in the Extended Security Update program, which provides security updates through October 31, 2026.

    Check the newer update, KB5094144
    Exchange Server 2016 has reached end of support. ESU security updates are scheduled to continue through October 31, 2026.

    Key changes 1 CVE · 1 change

    • Fix Exchange Server: A spoofing vulnerability in Exchange Server is addressed.
    • CVSS 6.5 CVE-2026-21527: Microsoft Exchange Server Spoofing Vulnerability

    Read update Source: Microsoft

    Build
    15.1.2507.66
    Security
    1 vulnerability fixed
  • Exchange Server Subscription Edition RTM Exchange Server Subscription Edition RTM Security update

    KB5071876

    Exchange privilege and spoofing flaws addressed; OWA integration fixed

    Addresses three Exchange Server vulnerabilities and fixes a Skype for Business integration failure in Outlook on the web.

    Check the newer update, KB5074992

    Key changes 3 CVEs · 1 change

    • Fix Outlook on the web: Skype for Business integration with Outlook on the web works after enabling the Dedicated Hybrid Application.
    • CVSS 7.5 CVE-2025-64666: Microsoft Exchange Server Elevation of Privilege Vulnerability
    • CVSS 5.3 CVE-2025-64667: Microsoft Exchange Server Spoofing Vulnerability

    Read update Source: Microsoft

    Build
    15.2.2562.35
    Security
    3 vulnerabilities fixed
    Restart
    Required
  • Exchange Server 2019 CU15 Exchange Server 2019 CU15 ESU only Security update

    KB5071875

    Mail-server elevation-of-privilege and spoofing flaws patched

    The update resolves two Exchange Server 2019 CU15 security vulnerabilities: an elevation-of-privilege flaw and a spoofing flaw. Only organizations enrolled in the Extended Security Update program are eligible.

    Check the newer update, KB5074993
    Exchange Server 2019 has reached end of support. Organizations enrolled in ESU can receive security updates through October 31, 2026.

    Key changes 2 CVEs · 1 change

    • Fix Exchange Server: The update resolves an elevation-of-privilege vulnerability and a spoofing vulnerability in Exchange Server.
    • CVSS 7.5 CVE-2025-64666: Microsoft Exchange Server Elevation of Privilege Vulnerability
    • CVSS 5.3 CVE-2025-64667: Microsoft Exchange Server Spoofing Vulnerability

    Read update Source: Microsoft

    Build
    15.2.1748.42
    Security
    2 vulnerabilities fixed
  • Exchange Server 2019 CU14 Exchange Server 2019 CU14 ESU only Security update

    KB5071874

    Exchange privilege escalation and spoofing flaws addressed

    Addresses two important Exchange Server vulnerabilities: one involving privilege escalation and one involving spoofing. Only organizations enrolled in the Extended Security Update program are eligible.

    Check the newer update, KB5074994
    Exchange Server 2019 has reached end of support. Only organizations enrolled in the Extended Security Update program are eligible for these and subsequent security updates.

    Key changes 2 CVEs · 2 changes

    • Fix Exchange Server: An Exchange Server elevation-of-privilege vulnerability is addressed.
    • Fix Exchange Server: An Exchange Server spoofing vulnerability is addressed.
    • CVSS 7.5 CVE-2025-64666: Microsoft Exchange Server Elevation of Privilege Vulnerability

    Read update Source: Microsoft

    Build
    15.2.1544.37
    Security
    2 vulnerabilities fixed
  • Exchange Server 2016 CU23 Exchange Server 2016 CU23 ESU only Security update

    KB5071873

    Privilege escalation and spoofing flaws addressed

    Resolves two important security flaws: one could give an attacker more access, and the other could let an attacker fake an identity.

    Check the newer update, KB5074995
    ESU security updates for Exchange Server 2016 are scheduled to end October 31, 2026.

    Key changes 2 CVEs · 2 changes

    • Fix Exchange Server: A flaw that could give an attacker more access is fixed.
    • Fix Exchange Server: A flaw that could let an attacker fake an identity is fixed.
    • CVSS 7.5 CVE-2025-64666: Microsoft Exchange Server Elevation of Privilege Vulnerability

    Read update Source: Microsoft

    Build
    15.1.2507.63
    Security
    2 vulnerabilities fixed
  • Exchange Server Subscription Edition RTM Exchange Server Subscription Edition RTM Security update

    KB5066366

    Auth Certificate export via cmdlet no longer supported

    The update addresses three Important vulnerabilities in Exchange Server. It also notes that Auth Certificate export through the Exchange cmdlet is no longer supported.

    Check the newer update, KB5071876

    Key changes 3 CVEs · 1 change

    • Fix Auth Certificate export: Auth Certificate export through the Exchange cmdlet is no longer supported.
    • CVSS 8.8 CVE-2025-59249: Microsoft Exchange Server Elevation of Privilege Vulnerability
    • CVSS 8.4 CVE-2025-53782: Microsoft Exchange Server Elevation of Privilege Vulnerability

    Read update Source: Microsoft

    Build
    15.2.2562.29
    Security
    3 vulnerabilities fixed
    Restart
    Required
  • Exchange Server 2019 CU15 Exchange Server 2019 CU15 ESU only Security update

    KB5066367

    Three vulnerabilities fixed; Auth Certificate export no longer supported

    The update fixes three important vulnerabilities and makes Auth Certificate export through an Exchange cmdlet no longer supported.

    Check the newer update, KB5071875
    Exchange Server 2019 ESU security updates end on October 31, 2026.

    Key changes 3 CVEs · 2 changes

    • Fix Security: The update fixes three vulnerabilities in Exchange Server.
    • Removed Auth Certificate export: Exporting the Auth Certificate through an Exchange cmdlet is no longer supported.
    • CVSS 8.8 CVE-2025-59249: Microsoft Exchange Server Elevation of Privilege Vulnerability

    Read update Source: Microsoft

    Build
    15.2.1748.39
    Security
    3 vulnerabilities fixed
  • Exchange Server 2019 CU14 Exchange Server 2019 CU14 ESU only Security update

    KB5066368

    Exchange vulnerabilities patched; Auth Certificate export ends

    Fixes three Important Exchange Server vulnerabilities and removes Auth Certificate export through an Exchange cmdlet. It is available only to organizations in the Extended Security Update program.

    Check the newer update, KB5071874
    Exchange Server 2019 ESU security updates are scheduled to end on October 31, 2026.

    Key changes 3 CVEs · 2 changes

    • Fix Exchange Server: The update fixes three security vulnerabilities in Exchange Server.
    • Removed Exchange cmdlets: Auth Certificate export through an Exchange cmdlet is no longer supported.
    • CVSS 8.8 CVE-2025-59249: Microsoft Exchange Server Elevation of Privilege Vulnerability

    Read update Source: Microsoft

    Build
    15.2.1544.36
    Security
    3 vulnerabilities fixed
  • Exchange Server 2016 CU23 Exchange Server 2016 CU23 ESU only Security update

    KB5066369

    Three vulnerabilities addressed; Auth Certificate export issue fixed

    The update addresses three Exchange Server vulnerabilities and an Auth Certificate export issue. It is available only to organizations in the Extended Security Update program.

    Check the newer update, KB5071873

    Key changes 3 CVEs · 1 change

    • Fix Auth Certificate export: The Auth Certificate export issue involving an Exchange cmdlet is addressed; export through that cmdlet is no longer supported.
    • CVSS 8.8 CVE-2025-59249: Microsoft Exchange Server Elevation of Privilege Vulnerability
    • CVSS 8.4 CVE-2025-53782: Microsoft Exchange Server Elevation of Privilege Vulnerability

    Read update Source: Microsoft

    Build
    15.1.2507.61
    Security
    3 vulnerabilities fixed
  • Exchange Server Subscription Edition RTM Exchange Server Subscription Edition RTM Hotfix update

    KB5066373

    Fixes failed online archiving for hybrid on-premises mailboxes

    Online archiving works again for affected hybrid Exchange mailboxes after this hotfix, which addresses a non-security issue.

    Check the newer update, KB5066366

    Key changes 1 change

    • Fix Online archiving: Retention-tagged items configured to move to an online archive are moved automatically again for affected hybrid mailboxes.

    Read update Source: Microsoft

    Build
    15.2.2562.27
    Restart
    Required
  • Exchange Server 2019 CU15 Exchange Server 2019 CU15 ESU only Hotfix update

    KB5066372

    Hybrid online archiving resumes automatic moves to archive

    Automatic moves to Exchange Online archives work again for on-premises mailboxes in a hybrid setup using the dedicated Exchange Hybrid Application feature.

    Check the newer update, KB5066367

    Key changes 1 change

    • Fix Online archiving: Items tagged to move to an online archive are automatically moved again for on-premises users in a hybrid setup.

    Read update Source: Microsoft

    Build
    15.2.1748.37
  • Exchange Server 2019 CU14 Exchange Server 2019 CU14 ESU only Hotfix update

    KB5066371

    Automatic online archiving works again in hybrid environments

    This hotfix restores automatic movement of archive-tagged items to Exchange Online archives when the primary mailbox is on-premises in a hybrid environment.

    Check the newer update, KB5066368

    Key changes 1 change

    • Fix Online archiving: Items tagged to move to an online archive are automatically moved again when the primary mailbox is on-premises in a hybrid environment...

    Read update Source: Microsoft

    Build
    15.2.1544.34
  • Exchange Server 2016 CU23 Exchange Server 2016 CU23 ESU only Hotfix update

    KB5066370

    Hybrid online archiving resumes for on-premises mailboxes

    Restores automatic online archiving for some on-premises mailboxes in hybrid environments. This update is available only to organizations enrolled in Extended Security Updates.

    Check the newer update, KB5066369

    Key changes 1 change

    • Fix Online archiving: Items configured to move to an online archive are moved automatically again for affected on-premises users in hybrid environments.

    Read update Source: Microsoft

    Build
    15.1.2507.59
  • Exchange Server Subscription Edition RTM Exchange Server Subscription Edition RTM Security update

    KB5063224

    Four Exchange flaws fixed; eDiscovery and public-folder issues resolved

    Addresses four Important Exchange Server vulnerabilities and fixes problems with eDiscovery exports, application pools after MSIPC is enabled, and public-folder permissions in Outlook.

    Check the newer update, KB5066373

    Key changes 4 CVEs · 3 changes

    • Fix eDiscovery: eDiscovery search results can be exported to a discovery mailbox again.
    • Fix Application pools: Application pools no longer stop responding, and performance is no longer affected after MSIPC is enabled.
    • Fix Public folders: Public-folder management in Outlook no longer modifies the incorrect ACE.

    Read update Source: Microsoft

    Build
    15.2.2562.20
    Security
    4 vulnerabilities fixed
  • Exchange Server 2019 CU15 Exchange Server 2019 CU15 ESU only Security update

    KB5063221

    Four vulnerabilities addressed; eDiscovery and app-pool issues fixed

    The update addresses four Important vulnerabilities and fixes eDiscovery exports, unresponsive application pools after MSIPC is enabled, and incorrect ACE changes through Outlook public-folder management.

    Check the newer update, KB5066372

    Key changes 4 CVEs · 3 changes

    • Fix eDiscovery: eDiscovery search results can be exported to a discovery mailbox again.
    • Fix Application pools: Application pools no longer stop responding and affect performance after MSIPC is enabled.
    • Fix Public folder management: Outlook no longer modifies the incorrect ACE through public folder management.

    Read update Source: Microsoft

    Build
    15.2.1748.36
    Security
    4 vulnerabilities fixed
  • Exchange Server 2019 CU14 Exchange Server 2019 CU14 ESU only Security update

    KB5063222

    Four server flaws addressed; eDiscovery exports restored

    The update addresses four Important vulnerabilities and fixes eDiscovery export problems. It is available only to organizations in the Extended Security Update program.

    Check the newer update, KB5066371

    Key changes 4 CVEs · 4 changes

    • Improved Security update replacement: This update replaces KB5049233.
    • Fix eDiscovery: eDiscovery search results can be exported to a discovery mailbox again.
    • Fix Application pools: Application pools no longer stop responding and affect performance after MSIPC is enabled.

    Read update Source: Microsoft

    Build
    15.2.1544.33
    Security
    4 vulnerabilities fixed
  • Exchange Server 2016 CU23 Exchange Server 2016 CU23 ESU only Security update

    KB5063223

    eDiscovery export failures fixed alongside four vulnerabilities

    The update addresses four Important vulnerabilities and fixes failures with eDiscovery exports, application pools, and public folder management in Outlook.

    Check the newer update, KB5066370

    Key changes 4 CVEs · 3 changes

    • Fix eDiscovery search results: eDiscovery search results can be exported to a discovery mailbox again.
    • Fix Application pools: Application pools no longer stop responding and affect performance after MSIPC is enabled.
    • Fix Public folder management in Outlook: Public folder management in Outlook modifies the correct ACE instead of an incorrect one.

    Read update Source: Microsoft

    Build
    15.1.2507.58
    Security
    4 vulnerabilities fixed
  • Exchange Server 2019 CU15 Exchange Server 2019 CU15 ESU only Hotfix update

    KB5057651

    Edge Transport stalls and StoreWorker failures fixed

    This optional hotfix fixes four Exchange Server 2019 issues, including Edge Transport service failures and StoreWorker problems that can quarantine mailboxes. It also includes the November 2024 security updates.

    Check the newer update, KB5063221
    Exchange Online is retiring access to cloud archive mailboxes through OWA for users whose primary mailbox is on-premises. The page does not specify an action to take.

    Key changes 4 changes

    • Fix Journal messages: Fixes the journal message issue that returns “ConversionFailedException.”
    • Fix Calendar printing in OWA: Fixes the issue that prevents calendar printing in Outlook on the web.
    • Fix Edge Transport service: Fixes the issue that makes the Edge Transport service stop responding after certain updates.

    Read update Source: Microsoft

    Build
    15.2.1748.26
  • Exchange Server 2019 CU14 Exchange Server 2019 CU14 ESU only Hotfix update

    KB5057652

    Azure RMS transport failures and quarantined mailboxes addressed

    This hotfix fixes OWA calendar printing, journal-message conversion errors, StoreWorker failures that can quarantine mailboxes, and Edge Transport crashes when decrypting externally sent Azure RMS-protected messages. It also retires OWA access to Exchange Online archives for people with on-premises primary mailboxes.

    Check the newer update, KB5063222
    Exchange Online is retiring OWA access to archive mailboxes for people whose primary mailbox is hosted on-premises. The announcement gives no action to take.

    Key changes 5 changes

    • Fix Journal messages: Journal messages no longer get stuck in the submission queue with a ConversionFailedException.
    • Fix Calendar printing in OWA: Printing a calendar from OWA works again instead of producing no print job on screen.
    • Fix Edge Transport service: The Edge Transport service no longer stops responding and restarting when Exchange Server decrypts externally sent messages protected b...

    Read update Source: Microsoft

    Build
    15.2.1544.27
  • Exchange Server 2016 CU23 Exchange Server 2016 CU23 ESU only Hotfix update

    KB5057653

    Journal delivery, calendar printing and mailbox quarantine issues fixed

    This hotfix addresses four Exchange issues, including journal messages stuck in submission and mailboxes quarantined after a background process stops responding. It is for organizations enrolled in the Extended Security Update program.

    Check the newer update, KB5063223
    Exchange Online is retiring access through Outlook on the web to an online archive for users whose primary mailbox is on-premises. The notice does not specify an action to take.

    Key changes 4 changes

    • Fix Journal messages: Journal messages that fail during content conversion can get stuck in the submission queue; this hotfix fixes the issue.
    • Fix Outlook on the web: The listed calendar-printing issue covers Exchange Server 2019 CU14 after its March 2024 security update: selecting Print produces no p...
    • Fix Edge Transport service: The Edge Transport service can stop responding and restart while handling certain externally protected messages; this hotfix fixes the...

    Read update Source: Microsoft

    Build
    15.1.2507.57
  • Exchange Server 2019 CU15 Exchange Server 2019 CU15 ESU only Hotfix update

    KB5050672

    An important mail-server vulnerability addressed

    This hotfix addresses one important security vulnerability in Exchange Server 2019 CU15. It is available only to organizations enrolled in the Extended Security Update program.

    Check the newer update, KB5057651

    Key security notes 1 CVE

    • CVSS 8.0 CVE-2025-53786: Microsoft Exchange Server Hybrid Deployment Elevation of Privilege Vulnerability

    Read update Source: Microsoft

    Build
    15.2.1748.24
    Security
    1 vulnerability fixed