Skip to the content
The Update Bureau
Exchange Server 2019 CU15 Exchange Server 2019 CU15 ESU only Security update
Patch Tuesday Zero-day

KB5094140

KB5094140: Security update for Exchange Server 2019 CU15, June 2026. Mail-server spoofing flaw patched; one remote-code flaw remains open

In short

The update closes Exchange Server vulnerabilities, including a critical spoofing flaw known to be exploited. It does not include a fix for CVE-2026-45583; follow that CVE’s documentation for instructions.

Does it affect you? Applies to: Exchange Server 2019 CU15, build 15.2.1748.46. Because Exchange Server 2019 is out of support, this update is available only to organizations enrolled in the Extended Security Update (ESU) program.

Build
15.2.1748.46
Servicing branch
CU15
Security
8 fixed · 1 critical · 1 exploited

For servers running Cumulative Update 15: each cumulative update gets its own update. Support for this version ended on October 14, 2025: Microsoft releases this update only to organizations enrolled in the Extended Security Update (ESU) program, not through Microsoft Update. The others should move to Exchange Server Subscription Edition. Which version am I on?

What changes

Fixes 2 changes

Exchange Server security

  • The update closes Exchange Server security vulnerabilities, including a critical spoofing flaw.1
    The listed fixes cover CVE-2026-42897, CVE-2026-45500, CVE-2026-45501, CVE-2026-45502, CVE-2026-45503, CVE-2026-45504, and CVE-2026-47631. CVE-2026-45583 is not fixed by this update.

Exchange mitigation and flighting services

  • Exchange mitigation and flighting services no longer fail with an “Unknown Issuer” error.2

Improvement 1 change

Exchange Server security

  • CVE-2026-45583, a remote code execution vulnerability, is not fixed by this update. Follow the instructions in the CVE documentation to address it.3

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2026-06-09
Classification
Security Updates
Type
Cumulative update
Servicing branch
CU15
Replaces
KB5074993
Replaced by
KB5103213
VersionBuildChannel
2019 15.2.1748.46 General availability

Security

8 vulnerabilities fixed
1 exploited 1 critical 7 not rated
VulnerabilitySeverityCVSS
CVE-2026-42897 Exploited
Microsoft Exchange Server Spoofing Vulnerability
 Critical 8.1
CVE-2026-45500
Microsoft Exchange Server Spoofing Vulnerability
 Not rated —
CVE-2026-45501
Microsoft Exchange Server Spoofing Vulnerability
 Not rated —
CVE-2026-45502
Microsoft Exchange Server Information Disclosure Vulnerability
 Not rated —
CVE-2026-45503
Microsoft Exchange Server Information Disclosure Vulnerability
 Not rated —
CVE-2026-45504
Microsoft Exchange Server Elevation of Privilege Vulnerability
 Not rated —
CVE-2026-45583
Microsoft Exchange Server Remote Code Execution Vulnerability
 Not rated —
CVE-2026-47631
Microsoft Exchange Server Spoofing Vulnerability
 Not rated —

Updated components

1,281 files changed since the previous update for the same versions.

Top changed componentsFiles
Management and PowerShell157
Transport93
Client access (POP, IMAP, ActiveSync)33
Mailbox replication33
Search27
Compliance and eDiscovery26
Exchange Web Services and Autodiscover17
Outlook on the web8
Setup8

Sources

Updated
Cited passages from Microsoft's official notes (3)
  1. 1. This security update resolves vulnerabilities in Microsoft Exchange Server. support.microsoft.com
  2. 2. Exchange mitigation and flighting services fail due to "Unknown Issuer" error support.microsoft.com
  3. 3. The fix for CVE-2026-45583 is not included in the Security Update, please follow the instructions mentioned in the CVE documentation to address this vulnerability. support.microsoft.com
Checked automatically: 7 of 8 checks passed, 3 quoted passages · compared with Microsoft's page on Sep 26, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: not passed

A second AI read the text against the sources: correctness 5/5, clarity 5/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake