Skip to the content
The Update Bureau

Exchange Server SE

Exchange Server Subscription Edition

Every published release for Exchange Server Subscription Edition, newest first: what each update changes, whether to install it and any confirmed known issues.

Latest
KB5133453 Nov 10, 2026
Build
15.2.2562.57
Released
Jul 1, 2025
Known issues
4 open

Latest update

  • KB5133453 Released Nov 10, 2026
    Build 15.2.2562.57

Build history

  • Exchange Server Subscription Edition RTM Exchange Server Subscription Edition RTM Security update
    Updated

    KB5133453

    Critical mail-server flaw patched; hybrid free/busy corrected

    A critical remote-code flaw in Exchange is patched. Hybrid users can also see correct free/busy details in classic Outlook.

    Key changes 9 CVEs · 2 changes

    • Fix Free/busy availability: On-premises users in hybrid setups can see correct free/busy details for Exchange Online mailboxes in classic Outlook.
    • Fix Server stability: Exchange server instability after the October 2026 Windows Server updates is resolved by installing the November 2026 Windows Server up...
    • Critical CVE-2026-118207: Microsoft Exchange Server Remote Code Execution Vulnerability

    Read update Source: Microsoft

    Build
    15.2.2562.57
    Security
    9 fixed · 1 critical
  • Exchange Server Subscription Edition RTM Exchange Server Subscription Edition RTM Security update
    Updated

    KB5128895

    Critical remote-code-execution flaw patched; calendar feeds restored

    The update fixes a Critical remote-code-execution vulnerability and restores published calendar feeds and Korean-language search processing affected by earlier updates.

    Check the newer update, KB5133453

    Key changes 6 CVEs · 2 changes

    • Fix Published calendar (.ics): Subscriptions to anonymously published calendars refresh again instead of returning an HTTP 500 error.
    • Fix ContentEngine: Processing Korean-language email no longer triggers the deadlock described in the issue, which could cause missing search results, dela...
    • Critical CVE-2026-70571: Microsoft Exchange Server Remote Code Execution Vulnerability

    Read update Source: Microsoft

    Build
    15.2.2562.56
    Security
    6 fixed · 1 critical
  • Exchange Server Subscription Edition RTM Exchange Server Subscription Edition RTM Out-of-band security update
    Out-of-band

    KB5129955

    Exchange vulnerabilities patched; hybrid free/busy times corrected

    Nine Exchange vulnerabilities are addressed, and two hybrid mailbox problems are resolved: wrapper messages in shared mailboxes and shifted free/busy times.

    Check the newer update, KB5128895
    Known issues: 3 open Organizations and IT administrators
    • Published calendar (.ics) returns HTTP 500 for calendar applications
    • Availability (free/busy) fails for delegated mailboxes in Exchange hybrid deployments using Graph API only
    • A ContentEngine deadlock occurs because of missing Korean WordBreaker rule files

    Key changes 9 CVEs · 2 changes

    • Fix Shared mailboxes: Wrapper messages no longer appear in shared mailboxes in hybrid environments.
    • Fix Hybrid free/busy: Free/busy results no longer show busy times shifted by the requester’s time zone.
    • CVSS 8.8 CVE-2026-96940: Microsoft Exchange Server Elevation of Privilege Vulnerability

    Read update Source: Microsoft

    Build
    15.2.2562.53
    Security
    9 vulnerabilities fixed
  • Exchange Server Subscription Edition RTM Exchange Server Subscription Edition RTM Security update

    KB5121608

    Exchange vulnerabilities addressed; published calendar feeds may fail

    Security flaws are addressed, but published calendar feeds and Korean-content processing have known issues.

    Check the newer update, KB5129955
    Known issues: 3 open Organizations and IT administrators
    • Published calendar (.ics) returns HTTP 500 for calendar applications
    • Availability (free/busy) fails for delegated mailboxes in Exchange hybrid deployments using Graph API only
    • A ContentEngine deadlock occurs because of missing Korean WordBreaker rule files

    Key changes 9 CVEs · 2 changes

    • Fix Shared mailboxes: In the hybrid setup described in the issue article, wrapper messages no longer appear in shared mailbox inboxes.
    • Fix Free/busy: Hybrid free/busy results no longer shift busy times by the requester's time zone in the scenario described.
    • CVSS 9.3 CVE-2026-69356: Microsoft Exchange Server Spoofing Vulnerability

    Read update Source: Microsoft

    Build
    15.2.2562.49
    Security
    9 vulnerabilities fixed
  • Exchange Server Subscription Edition RTM Exchange Server Subscription Edition RTM Security update

    KB5121573

    Exchange privilege flaw addressed; published calendar feeds can fail

    A critical Exchange privilege-escalation flaw is addressed. Published calendar subscriptions might stop refreshing and return HTTP 500.

    Check the newer update, KB5121608
    Known issues: 3 open Organizations and IT administrators
    • Published calendar (.ics) returns HTTP 500 for calendar applications
    • Availability (free/busy) fails for delegated mailboxes in Exchange hybrid deployments using Graph API only
    • Wrapper messages appear in shared mailbox in hybrid environments after installing the June 2026 Security Update

    Key changes 7 CVEs · 1 change

    • Fix Exchange Server: The update addresses a critical flaw that could let an attacker gain higher privileges in Exchange Server.
    • Critical CVE-2026-62911: Microsoft Exchange Server Elevation of Privilege Vulnerability
    • CVSS 8.8 CVE-2026-62913: Microsoft Exchange Server Remote Code Execution Vulnerability

    Read update Source: Microsoft

    Build
    15.2.2562.46
    Security
    7 fixed · 1 critical
  • Exchange Server Subscription Edition RTM Exchange Server Subscription Edition RTM Security update

    KB5103212

    Critical Exchange spoofing flaw addressed; mailbox issue remains

    A critical Exchange spoofing vulnerability is addressed. Hybrid shared mailboxes might still receive wrapper messages after the June security update; KB5121608 or later resolves the issue.

    Check the newer update, KB5121573
    Known issues: 1 open Organizations and IT administrators
    • Wrapper messages appear in shared mailbox in hybrid environments after installing the June 2026 Security Update

    Key changes 11 CVEs · 1 change

    • Fix Exchange Server: Exchange Server's critical spoofing vulnerability is addressed.
    • Critical CVE-2026-55008: Microsoft Exchange Server Spoofing Vulnerability
    • CVSS 8.8 CVE-2026-45504: Microsoft Exchange Server Elevation of Privilege Vulnerability

    Read update Source: Microsoft

    Build
    15.2.2562.45
    Security
    11 fixed · 1 critical
  • Exchange Server Subscription Edition RTM Exchange Server Subscription Edition RTM Security update
    Zero-day

    KB5094139

    Critical exploited spoofing flaw patched; mitigation services recover

    The update addresses Exchange vulnerabilities, including the actively exploited critical spoofing flaw CVE-2026-42897. It lists eight CVEs, but does not include the fix for CVE-2026-45583; follow that CVE’s guidance.

    Check the newer update, KB5103212

    Key changes 8 CVEs · 1 change

    • Fix Exchange mitigation and flighting services: Exchange mitigation and flighting services no longer fail with an “Unknown Issuer” error.
    • Exploited CVE-2026-42897: Microsoft Exchange Server Spoofing Vulnerability
    • Security CVE-2026-45500: Microsoft Exchange Server Spoofing Vulnerability

    Read update Source: Microsoft

    Build
    15.2.2562.43
    Security
    8 fixed · 1 critical · 1 exploited
  • Exchange Server Subscription Edition RTM Exchange Server Subscription Edition RTM Hotfix update

    KB5081755

    Microsoft Graph adds hybrid free/busy and profile sharing

    Exchange Server SE RTM gains Microsoft Graph support for hybrid free/busy and profile picture sharing, plus partial MailTips support. The change replaces EWS in most hybrid scenarios ahead of its scheduled retirement from Exchange Online in October 2026.

    Check the newer update, KB5094139
    EWS is scheduled to retire from Exchange Online in October 2026; this change replaces its use in most hybrid scenarios.

    Key changes 1 change

    • New Microsoft Graph: Hybrid deployments can use Microsoft Graph for free/busy information and profile picture sharing, and for MailTips in some cases.

    Read update Source: Microsoft

    Build
    15.2.2562.41
  • Exchange Server Subscription Edition RTM Exchange Server Subscription Edition RTM Security update

    KB5074992

    Spoofing vulnerability in Exchange addressed

    Resolves CVE-2026-21527, a spoofing vulnerability in Exchange Server.

    Check the newer update, KB5081755

    Key changes 1 CVE · 1 change

    • Fix Exchange Server: The update resolves a spoofing vulnerability in Exchange Server.
    • CVSS 6.5 CVE-2026-21527: Microsoft Exchange Server Spoofing Vulnerability

    Read update Source: Microsoft

    Build
    15.2.2562.37
    Security
    1 vulnerability fixed
    Restart
    Required
  • Exchange Server Subscription Edition RTM Exchange Server Subscription Edition RTM Security update

    KB5071876

    Exchange privilege and spoofing flaws addressed; OWA integration fixed

    Addresses three Exchange Server vulnerabilities and fixes a Skype for Business integration failure in Outlook on the web.

    Check the newer update, KB5074992

    Key changes 3 CVEs · 1 change

    • Fix Outlook on the web: Skype for Business integration with Outlook on the web works after enabling the Dedicated Hybrid Application.
    • CVSS 7.5 CVE-2025-64666: Microsoft Exchange Server Elevation of Privilege Vulnerability
    • CVSS 5.3 CVE-2025-64667: Microsoft Exchange Server Spoofing Vulnerability

    Read update Source: Microsoft

    Build
    15.2.2562.35
    Security
    3 vulnerabilities fixed
    Restart
    Required
  • Exchange Server Subscription Edition RTM Exchange Server Subscription Edition RTM Security update

    KB5066366

    Auth Certificate export via cmdlet no longer supported

    The update addresses three Important vulnerabilities in Exchange Server. It also notes that Auth Certificate export through the Exchange cmdlet is no longer supported.

    Check the newer update, KB5071876

    Key changes 3 CVEs · 1 change

    • Fix Auth Certificate export: Auth Certificate export through the Exchange cmdlet is no longer supported.
    • CVSS 8.8 CVE-2025-59249: Microsoft Exchange Server Elevation of Privilege Vulnerability
    • CVSS 8.4 CVE-2025-53782: Microsoft Exchange Server Elevation of Privilege Vulnerability

    Read update Source: Microsoft

    Build
    15.2.2562.29
    Security
    3 vulnerabilities fixed
    Restart
    Required
  • Exchange Server Subscription Edition RTM Exchange Server Subscription Edition RTM Hotfix update

    KB5066373

    Fixes failed online archiving for hybrid on-premises mailboxes

    Online archiving works again for affected hybrid Exchange mailboxes after this hotfix, which addresses a non-security issue.

    Check the newer update, KB5066366

    Key changes 1 change

    • Fix Online archiving: Retention-tagged items configured to move to an online archive are moved automatically again for affected hybrid mailboxes.

    Read update Source: Microsoft

    Build
    15.2.2562.27
    Restart
    Required
  • Exchange Server Subscription Edition RTM Exchange Server Subscription Edition RTM Security update

    KB5063224

    Four Exchange flaws fixed; eDiscovery and public-folder issues resolved

    Addresses four Important Exchange Server vulnerabilities and fixes problems with eDiscovery exports, application pools after MSIPC is enabled, and public-folder permissions in Outlook.

    Check the newer update, KB5066373

    Key changes 4 CVEs · 3 changes

    • Fix eDiscovery: eDiscovery search results can be exported to a discovery mailbox again.
    • Fix Application pools: Application pools no longer stop responding, and performance is no longer affected after MSIPC is enabled.
    • Fix Public folders: Public-folder management in Outlook no longer modifies the incorrect ACE.

    Read update Source: Microsoft

    Build
    15.2.2562.20
    Security
    4 vulnerabilities fixed