Skip to the content
The Update Bureau

Exchange Server

Exchange Server updates

All published releases for Exchange Server, newest first: what each update changes, whether to install it and any confirmed known issues. Latest release: November 10, 2026.

13 active known issues →

Exchange Server updates

  • Exchange Server 2019 CU14 Exchange Server 2019 CU14 ESU only Hotfix update

    KB5050673

    Fixes 1 vulnerability

    The Exchange Server 2019 CU14 hotfix addresses one Important-severity vulnerability. It is available only to organizations enrolled in the Extended Security Update program.

    Check the newer update, KB5057652

    Key security notes 1 CVE

    • CVSS 8.0 CVE-2025-53786: Microsoft Exchange Server Hybrid Deployment Elevation of Privilege Vulnerability

    Read update Source: Microsoft

    Build
    15.2.1544.25
    Security
    1 vulnerability fixed
  • Exchange Server 2016 CU23 Exchange Server 2016 CU23 ESU only Hotfix update

    KB5050674

    Fixes 1 vulnerability

    This hotfix for Exchange Server 2016 CU23 addresses one Important-severity vulnerability. It is available only to organizations in the Extended Security Update program.

    Check the newer update, KB5057653

    Key security notes 1 CVE

    • CVSS 8.0 CVE-2025-53786: Microsoft Exchange Server Hybrid Deployment Elevation of Privilege Vulnerability

    Read update Source: Microsoft

    Build
    15.1.2507.55
    Security
    1 vulnerability fixed
  • Exchange Server 2016 / 2019 CU14 Exchange Server 2016 / 2019 CU14 ESU only Out-of-band security update
    Out-of-band

    KB5049233

    Transport and DLP rules work again after the earlier update

    Exchange Transport Rules and Data Loss Prevention rules work again after the earlier November update. The rerelease also addresses a publicly disclosed Exchange Server vulnerability.

    Check the newer update, KB5050673
    Known issues: 3 open Organizations and IT administrators
    • A time zone exception occurs after installing Exchange Server November 2024 SU (Version 1 or Version 2)
    • The Edge Transport service stops responding after installing November 2024 SU
    • A file version error occurs when you try to install Exchange Server November 2024 SU

    Key changes 1 CVE · 14 changes

    • New MSIPC: MSIPC is enabled by default in Exchange Server 2019 and 2016.
    • New AMSI: AMSI integration adds support for scanning message bodies.
    • New P2 FROM header detection: Exchange can detect P2 FROM headers that do not follow the RFC standard.

    Read update Source: Microsoft

    Builds
    15.1.2507.44 · 15.2.1258.39 · 15.2.1544.14
    Security
    1 vulnerability fixed
  • Exchange Server 2016 / 2019 CU14 Exchange Server 2016 / 2019 CU14 ESU only Security update

    KB5044062

    Transport rules can stop processing; Edge Transport can hang

    Exchange Transport Rules and DLP rules can stop processing after version 1, while Edge Transport can stop responding. The update addresses CVE-2024-49040; KB5049233 is the re-released version.

    Check the newer update, KB5049233
    Known issues: 4 open Organizations and IT administrators
    • Exchange Transport Rules and Data Loss Prevention rules don't work after installing November 2024 SU V1
    • A time zone exception occurs after installing Exchange Server November 2024 SU (Version 1 or Version 2)
    • and 2 more

    Key changes 1 CVE · 14 changes

    • New MSIPC: MSIPC is enabled by default in Exchange Server 2019 and 2016.
    • New AMSI: AMSI integration adds support for scanning message bodies.
    • New P2 FROM header: Exchange detects P2 FROM headers that do not follow RFC rules.

    Read update Source: Microsoft

    Builds
    15.1.2507.43 · 15.2.1258.38 · 15.2.1544.13
    Security
    1 vulnerability fixed
  • Exchange Server 2016 / 2019 CU14 Exchange Server 2016 / 2019 CU14 ESU only Hotfix update

    KB5037224

    ECC certificates added; CU14 adds HMA for OWA and ECP

    Adds Elliptic Curve Cryptography certificate support to Exchange 2016 and 2019, and Hybrid Modern Authentication for OWA and ECP on Exchange 2019 CU14. It also includes one Important security fix and resolves seven listed issues.

    Check the newer update, KB5044062

    Key changes 1 CVE · 9 changes

    • New Elliptic Curve Cryptography certificates: Exchange Server 2016 and 2019 support Elliptic Curve Cryptography certificates.
    • New Hybrid Modern Authentication: Exchange Server 2019 CU14 supports Hybrid Modern Authentication for OWA and ECP.
    • Fix OWA: The “We can't open this document” error in OWA after installing the March 2024 security update is fixed.

    Read update Source: Microsoft

    Builds
    15.1.2507.39 · 15.2.1258.34 · 15.2.1544.11
    Security
    1 vulnerability fixed
  • Exchange Server 2019 CU14 Exchange Server 2019 CU14 ESU only Security update

    KB5036401

    Attachment scanning loses support for some file types

    Text extraction stops for JPEG, TIFF, and AutoCAD attachments, which can affect some mail rules. EWS search results are also corrected.

    Check the newer update, KB5037224
    Known issues: 5 open Organizations and IT administrators
    • After you install this security update (SU), the program no longer supports the Oracle Outside In Technology (OIT) or OutsideInModule.
    • After you install this SU, Download Domains are no longer working as expected.
    • and 3 more

    Key changes 1 CVE · 1 change

    • Fix EWS search: EWS search requests no longer display inaccurate results.
    • Security CVE-2024-26198: Microsoft Exchange Server Remote Code Execution Vulnerability

    Read update Source: Microsoft

    Build
    15.2.1544.9
    Security
    1 vulnerability fixed
  • Exchange Server 2019 CU13 Exchange Server 2019 CU13 ESU only Security update

    KB5036402

    Exchange remote-code flaw patched; attachment text extraction removed

    A remote-code flaw in Exchange is patched. Text extraction from JPEG, TIFF, and AutoCAD attachments stops for transport rules and DLP scans.

    Check the newer update, KB5037224
    This update is for organizations enrolled in the Extended Security Update program.
    Known issues: 5 open Organizations and IT administrators
    • After you install this security update (SU), the program no longer supports the Oracle Outside In Technology (OIT) or OutsideInModule.
    • After you install this SU, Download Domains are no longer working as expected.
    • and 3 more

    Key changes 1 CVE · 2 changes

    • Fix EWS: EWS search requests no longer return inaccurate results.
    • Removed Attachment text extraction: Exchange no longer extracts text from JPEG, TIFF, or AutoCAD attachments for transport rules and DLP scans.
    • Security CVE-2024-26198: Microsoft Exchange Server Remote Code Execution Vulnerability

    Read update Source: Microsoft

    Build
    15.2.1258.32
    Security
    1 vulnerability fixed
  • Exchange Server 2016 CU23 Exchange Server 2016 CU23 ESU only Security update
    Zero-day

    KB5036386

    Exploited Exchange privilege flaw patched; attachment text scanning removed

    An exploited Exchange privilege flaw is patched, while attachment text extraction for some file types is removed. Several Outlook and OWA problems also need a later hotfix.

    Check the newer update, KB5037224
    Known issues: 5 open Organizations and IT administrators
    • After you install this security update (SU), the program no longer supports the Oracle Outside In Technology (OIT) or OutsideInModule.
    • After you install this SU, Download Domains are no longer working as expected.
    • and 3 more

    Key changes 2 CVEs · 2 changes

    • Fix EWS search: EWS searches no longer show inaccurate results.
    • Removed Attachment text extraction: Exchange no longer extracts text from JPEG, TIFF, or AutoCAD attachments for mail-flow checks. Attachment rules might not inspect their...
    • Exploited CVE-2024-21410: Microsoft Exchange Server Elevation of Privilege Vulnerability

    Read update Source: Microsoft

    Build
    15.1.2507.37
    Security
    2 fixed · 1 critical · 1 exploited
  • Exchange Server 2019 CU14 Exchange Server 2019 CU14 ESU only Security update
    Zero-day

    KB5035606

    Mail-server access flaw is under attack

    Fixes one critical flaw in Exchange Server 2019 CU14. Attackers are already using it to gain higher access.

    Check the newer update, KB5036401

    Key security notes 1 CVE

    • Exploited CVE-2024-21410: Microsoft Exchange Server Elevation of Privilege Vulnerability

    Read update Source: Microsoft

    Build
    15.2.1544.4
    Security
    1 fixed · 1 critical · 1 exploited