KB5044062: Security update for Exchange Server 2016 CU14, November 2024. Transport rules can stop processing; Edge Transport can hang

Exchange Transport Rules and DLP rules can stop processing after version 1, while Edge Transport can stop responding. The update addresses CVE-2024-49040; KB5049233 is the re-released version.

Does it affect you? Applies to: Exchange Server 2019 and 2016 servers, including Exchange Server 2019 CU14. This update is available only to organizations in the Extended Security Update program.

Review notes Additional details from the official release notes (2) Read notes

Known issues Install Exchange Server November 2024 security update version 2 (KB5049233) to fix the Transport Rules and DLP issue caused by version 1.
Known issues For Exchange Server 2019 CU14, install CU14 HU5 (KB5057652); for Exchange Server 2016, install CU23 HU16 (KB5057653). The article also lists CU15 HU2 (KB5057651) for Exchange Server 2019 CU15.

The official sources are linked at the end of the page.

For servers running Cumulative Update 14: each cumulative update gets its own update. Support for this version ended on October 14, 2025: Microsoft releases this update only to organizations enrolled in the Extended Security Update (ESU) program, not through Microsoft Update. The others should move to Exchange Server Subscription Edition. Which version am I on?

What changes

Fixes 10 changes

Exchange Server

Addresses an Exchange Server elevation-of-privilege vulnerability.¹
Addresses CVE-2024-49040.

Journal report decryption

Journal report decryption can decrypt attachments in journal mailboxes.²

Encrypted content

Fixes an error involving AES256-CBC-encrypted content.³

IRM messages

Exchange can decrypt IRM messages again.⁴

PowerShell ISE

Servers with PowerShell ISE serialize correctly when connecting to EMS.⁵

Pickup folder

Email sent through the Pickup folder no longer displays the admin version.⁶

Certificate signing

Exchange-created certificate signing requests use an up-to-date encryption algorithm.⁷

Outlook on the Web

Outlook on the Web shows the correct time zone for Amman.⁸

Time zones

Exchange accounts for Kazakhstan's change to a single time zone in 2024.⁹

Moderated messages

Moderated messages are no longer marked as expired after approval or rejection.¹⁰

New features 3 changes

MSIPC

MSIPC is enabled by default in Exchange Server 2019 and 2016.¹¹

AMSI

AMSI integration adds support for scanning message bodies.¹²

P2 FROM header

Exchange detects P2 FROM headers that do not follow RFC rules.¹³

Improvement 1 change

ECC certificates

Exchange improves support for ECC certificates.¹⁴

Known issues

Open Affects: Organizations and IT administrators

Exchange Transport Rules and Data Loss Prevention rules don't work after installing November 2024 SU V1

After November 2024 SU V1, Exchange might stop processing Transport Rules and DLP rules. The issue is listed for this update.¹⁵

Workaround status No workaround yet

Microsoft has not published a manual workaround for this issue yet. Monitor release health until a resolving update is available.
Open Affects: Organizations and IT administrators

A time zone exception occurs after installing Exchange Server November 2024 SU (Version 1 or Version 2)

After November 2024 SU version 1 or 2, calendar files might not preview or add to calendars. Exchange might also have trouble processing messages with calendar file attachments.¹⁶

How to apply the workaround Workaround

Removing the duplicate mapping addresses the time-zone exception described in the article.¹⁶
Step-by-step instructions, command & download kit
2 steps powershell.exe · Administrator Instructions (.txt)

Show steps & kit Hide steps & kit
Step-by-step procedure
1. Edit IanaTimeZoneMappings.xml in the Exchange V15\Bin folder and delete one of the two Asia/Bishkek entries.
2. Open PowerShell as administrator and run the listed service restart commands.
powershell.exe · Administrator

> Restart-Service -Name W3SVC, WAS -Force> Restart-Service -Name MSExchangeTransport
Open Affects: Organizations and IT administrators

The Edge Transport service stops responding after installing November 2024 SU

After the November 2024 SU or Exchange 2019 CU15, Edge Transport might stop responding when Exchange decrypts messages protected by Azure Rights Management. This can occur with Journal Report Decryption enabled.¹⁷

How to apply the workaround Exchange Management Shell

The workaround disables the MSIPC stack, which is enabled by default in the November 2024 security update.¹⁷
Step-by-step instructions, command & download kit
1 step Exchange Management Shell Instructions (.txt)

Show steps & kit Hide steps & kit
Step-by-step procedure
1. Run the commands in an elevated Exchange Management Shell.
Exchange Management Shell

> New-SettingOverride –Name "DisableMSIPC" -Component Encryption –Section UseMSIPC –Parameters @("Enabled=false") -Reason "Disabling MSIPC stack"> Get-ExchangeDiagnosticInfo -Process Microsoft.Exchange.Directory.TopologyService -Component VariantConfiguration -Argument Refresh> Restart-Service MSExchangeTransport
Open Affects: Organizations and IT administrators

A file version error occurs when you try to install Exchange Server November 2024 SU

Installing the November 2024 SU might fail with a file-version error. A retry might return error 1603.¹⁸

How to apply the workaround Workaround

Restart the server, check the Exchange services and .NET Framework 4.8, restore service startup settings if needed, then retry the installation.¹⁸
Step-by-step instructions, command & download kit
4 steps powershell.exe · Administrator Instructions (.txt)

Show steps & kit Hide steps & kit
Step-by-step procedure
1. Restart the Exchange server.
2. Check the Exchange service status. If services are disabled, use ServiceControl.ps1 AfterPatch to restore their startup settings.
3. Check that the .NET Framework 4.8 update is installed; if it is not, install it through Windows Update.
4. Rerun the November 2024 SU installation.
powershell.exe · Administrator

> Get-Service -DisplayName "Microsoft exchange*" | ft DisplayName,Starttype ,Status> cd "C:\Program Files\Microsoft\Exchange Server\V15\Bin"> Add-PSSnapin -Name Microsoft.Exchange.Management.PowerShell.Setup -ErrorAction SilentlyContinue> .\ServiceControl.ps1 AfterPatch> Get-Hotfix

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released: 2024-11-12
Classification: Security Updates
Type: Cumulative update
Servicing branch: CU14
Replaces: KB5037224
Replaced by: KB5049233

Version	Build	Channel
2016	15.1.2507.43	General availability
2019	15.2.1258.38	General availability
2019	15.2.1544.13	General availability

Security

1 vulnerability fixed

1 not rated

Vulnerability	Severity	CVSS
CVE-2024-49040 Microsoft Exchange Server Spoofing Vulnerability	Not rated	—

Sources

Updated Nov 8, 2026

Cited passages from Microsoft's official notes (18)

1. CVE-2024-49040 - Microsoft Exchange Server Elevation of Privilege Vulnerability support.microsoft.com
2. Journal report decryption doesn't decrypt attachment in journal mailbox support.microsoft.com
3. Error after adding support for AES256-CBC–encrypted content in August 2023 SU support.microsoft.com
4. Exchange can't decrypt IRM messages support.microsoft.com
5. Server with PowerShell\_ISE doesn't serialize when connecting to EMS support.microsoft.com
6. Email sent through Pickup folder displays admin version support.microsoft.com
7. CSR created by Exchange are signed with outdated Encryption algorithm support.microsoft.com
8. OWA displays incorrect time zone for Amman support.microsoft.com
9. Kazakhstan changes to single time zone in 2024 support.microsoft.com
10. Moderated messages are marked as expired after they are approved or rejected support.microsoft.com
11. MSIPC enabled by default in Exchange Server 2019 and 2016 support.microsoft.com
12. AMSI integration body scanning support support.microsoft.com
13. Non-RFC compliant P2 FROM header detection support.microsoft.com
14. ECC certificate support improvements support.microsoft.com
15. After you install the Microsoft Exchange Server 2019 or 2016 November 2024 security update (SU) Version 1, Exchange Server stops processing Exchange Transport Rules (ETR) and Data Loss Prevention (DLP) rules. support.microsoft.com
16. This issue occurs because Exchange Server uses a duplicate entry in the IanaTimeZoneMappings.xml file. support.microsoft.com
17. To work around this issue, disable Microsoft Information Protection Client (MSIPC). MSIPC is enabled by default in the November 2024 Security Update. support.microsoft.com
18. If the StartType value for Microsoft Exchange services is Disabled, run the following command in Windows PowerShell to restore the StartType: support.microsoft.com

Checked automatically: 7 of 8 checks passed, 18 quoted passages · compared with Microsoft's page on Nov 8, 2026

Quotes found in the official pages: passed
Numbers found in the sources: passed
Vulnerabilities from the dossier only: passed
Links to allowed domains only: passed
Every official change covered: passed
Readable plain text: passed
Changes confirmed by the file list: passed
Sources agree: not passed

A second AI read the text against the sources: correctness 4/5, clarity 4/5, completeness 3/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake