Skip to the content
The Update Bureau
Exchange Server 2016 CU23 Exchange Server 2016 CU23 ESU only Security update
Patch Tuesday Zero-day

KB5036386

KB5036386: Security update for Exchange Server 2016 CU23, March 2024. Exploited Exchange privilege flaw patched; attachment text scanning removed

In short

An exploited Exchange privilege flaw is patched, while attachment text extraction for some file types is removed. Several Outlook and OWA problems also need a later hotfix.

Does it affect you? Applies to: Exchange Server 2016 CU23 x64 devices in organizations enrolled in the Extended Security Update program.

Build
15.1.2507.37
Servicing branch
CU23
Security
2 fixed · 1 critical · 1 exploited

For servers running Cumulative Update 23: each cumulative update gets its own update. Support for this version ended on October 14, 2025: Microsoft releases this update only to organizations enrolled in the Extended Security Update (ESU) program, not through Microsoft Update. The others should move to Exchange Server Subscription Edition. Which version am I on?

What changes

Fix 1 change

EWS search

  • EWS searches no longer show inaccurate results.1
    Fixes inaccurate results from an Exchange Web Services (EWS) search request.

Removal 1 change

Attachment text extraction

For: Organizations using attachment scanning rules

  • Exchange no longer extracts text from JPEG, TIFF, or AutoCAD attachments for mail-flow checks. Attachment rules might not inspect their contents.2
    The update disables Oracle Outside In Technology (OIT), also known as OutsideInModule, for text extraction in Exchange Transport Rules (ETR) and Data Loss Prevention (DLP) attachment checks.

Known issues

  1. Open Affects: Organizations and IT administrators

    After you install this security update (SU), the program no longer supports the Oracle Outside In Technology (OIT) or OutsideInModule.

    Exchange no longer extracts text from JPEG, TIFF, or AutoCAD attachments for mail-flow checks. This can affect attachment rules.2

    How to apply the workaround PowerShell

    A PowerShell script can override the setting that disables OIT. Microsoft advises against overriding it unless a functional issue affects the organization's mail flow.2

  2. Open Affects: Organizations and IT administrators

    After you install this SU, Download Domains are no longer working as expected.

    Users of some Outlook versions can no longer see inline images in OWA or download attachments through OWA. KB5037224 fixes this.3

    Workaround status No workaround yet

    Microsoft has not published a manual workaround for this issue yet. Monitor release health until a resolving update is available.

  3. Open Affects: Organizations and IT administrators

    After you install this SU, OwaDeepTestProbe and EacBackEndLogonProbe are no longer working.

    OwaDeepTestProbe and EacBackEndLogonProbe fail after installation, and their monitors show Unhealthy. KB5037224 fixes this.4

    Workaround status No workaround yet

    Microsoft has not published a manual workaround for this issue yet. Monitor release health until a resolving update is available.

  4. Open Affects: Organizations and IT administrators

    After you install this SU, you receive a "We're having trouble fetching results from the server" error message when you run a search in Microsoft Outlook cached mode.

    Outlook cached-mode searches show a “We're having trouble fetching results from the server” error. Searches work in online mode or OWA. KB5037224 fixes this.5

    Workaround status No workaround yet

    Microsoft has not published a manual workaround for this issue yet. Monitor release health until a resolving update is available.

  5. Open Affects: Organizations and IT administrators

    After you install this SU, you can't preview Microsoft Word documents in Outlook on the web (OWA), and you receive an error message.

    Word documents cannot be previewed in OWA, and an error appears. KB5037224 fixes this.6

    Workaround status No workaround yet

    Microsoft has not published a manual workaround for this issue yet. Monitor release health until a resolving update is available.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2024-03-12
Classification
Security Updates
Type
Cumulative update
Servicing branch
CU23
Replaced by
KB5037224
VersionBuildChannel
2016 15.1.2507.37 General availability

Security

2 vulnerabilities fixed
1 exploited 1 critical 1 not rated
VulnerabilitySeverityCVSS
CVE-2024-21410 Exploited
Microsoft Exchange Server Elevation of Privilege Vulnerability
 Critical 9.8
CVE-2024-26198
Microsoft Exchange Server Remote Code Execution Vulnerability
 Not rated —

Sources

Updated
Cited passages from Microsoft's official notes (6)
  1. 1. EWS search request displays inaccurate results support.microsoft.com
  2. 2. Starting in the Microsoft Exchange Server March 2024 security update, Exchange Server no longer uses “Oracle Outside In Technology” (also known as OutsideInModule or OIT) to perform text extraction workloads support.microsoft.com
  3. 3. Users who are using Outlook on the Web (OWA) to access their email can no longer see inline images. Additionally, no attachments can be downloaded by using the OWA client. support.microsoft.com
  4. 4. the OwaDeepTestProbe and EacBackEndLogonProbe probes begin to fail. This triggers an Unhealthy status of the EacBackEndLogonMonitor and OwaDeepTestMonitor monitors. support.microsoft.com
  5. 5. After you install the March 2024 security update for Microsoft Exchange Server 2019 and 2016, you receive the following error message when you run a search in Microsoft Outlook cached mode: support.microsoft.com
  6. 6. After you install the March 2024 security update for Microsoft Exchange Server 2019 and 2016, you can't preview Microsoft Word documents in Outlook on the web (OWA) support.microsoft.com
Checked automatically: 7 of 8 checks passed, 6 quoted passages · compared with Microsoft's page on Oct 20, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: not passed

A second AI read the text against the sources: correctness 5/5, clarity 4/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake