The Update BureauKB5094144: Security update for Exchange Server 2016 CU23, June 2026. Exchange spoofing flaw exploited; mitigation services error fixed
The update addresses Exchange Server vulnerabilities, including an actively exploited critical spoofing flaw. It does not include the fix for CVE-2026-45583.
Does it affect you? Applies to: Organizations running Exchange Server 2016 CU23. This update is available only to organizations enrolled in the Extended Security Update (ESU) program.
Review notes Additional details from the official release notes (1) Read note
- What to do The update does not include the fix for CVE-2026-45583. Microsoft says to follow the instructions in that CVE's documentation to address the vulnerability.
The official sources are linked at the end of the page.
For servers running Cumulative Update 23: each cumulative update gets its own update. Support for this version ended on October 14, 2025: Microsoft releases this update only to organizations enrolled in the Extended Security Update (ESU) program, not through Microsoft Update. The others should move to Exchange Server Subscription Edition. Which version am I on?
What changes
Fixes 2 changes
Exchange Server
For: Organizations running Exchange Server 2016 CU23
-
The update addresses Exchange Server vulnerabilities, but does not include the fix for CVE-2026-45583.1
The KB lists CVE-2026-42897, CVE-2026-45500, CVE-2026-45501, CVE-2026-45502, CVE-2026-45503, CVE-2026-45504, CVE-2026-45583, and CVE-2026-47631.
Exchange mitigation and flighting services
- The “Unknown Issuer” error that causes Exchange mitigation and flighting services to fail is fixed.2
Technical details
Data sheet · Security · Downloads · Components Click to collapse or expand
Data sheet
- Released
- 2026-06-09
- Classification
- Security Updates
- Type
- Cumulative update
- Servicing branch
- CU23
- Replaces
- KB5074995
- Replaced by
- KB5103215
| Version | Build | Channel |
|---|---|---|
| 2016 | 15.1.2507.69 | General availability |
Security
| Vulnerability | Severity | CVSS |
|---|---|---|
|
CVE-2026-42897
Exploited
Microsoft Exchange Server Spoofing Vulnerability
|
Critical | 8.1 |
|
Microsoft Exchange Server Spoofing Vulnerability
|
Not rated | — |
|
Microsoft Exchange Server Spoofing Vulnerability
|
Not rated | — |
|
Microsoft Exchange Server Information Disclosure Vulnerability
|
Not rated | — |
|
Microsoft Exchange Server Information Disclosure Vulnerability
|
Not rated | — |
|
Microsoft Exchange Server Elevation of Privilege Vulnerability
|
Not rated | — |
|
Microsoft Exchange Server Remote Code Execution Vulnerability
|
Not rated | — |
|
Microsoft Exchange Server Spoofing Vulnerability
|
Not rated | — |
Updated components
1,354 files changed since the previous update for the same versions.
| Top changed components | Files |
|---|---|
| Management and PowerShell | 154 |
| Transport | 94 |
| Client access (POP, IMAP, ActiveSync) | 33 |
| Mailbox replication | 33 |
| Search | 27 |
| Compliance and eDiscovery | 25 |
| Exchange Web Services and Autodiscover | 17 |
| Outlook on the web | 9 |
| Setup | 8 |
Sources
Cited passages from Microsoft's official notes (2)
-
1.
This security update resolves vulnerabilities in Microsoft Exchange Server.
support.microsoft.com -
2.
Exchange mitigation and flighting services fail due to "Unknown Issuer" error
support.microsoft.com
Checked automatically: 7 of 8 checks passed, 2 quoted passages · compared with Microsoft's page on Sep 26, 2026
- Quotes found in the official pages: passed
- Numbers found in the sources: passed
- Vulnerabilities from the dossier only: passed
- Links to allowed domains only: passed
- Every official change covered: passed
- Readable plain text: passed
- Changes confirmed by the file list: passed
- Sources agree: not passed
A second AI read the text against the sources: correctness 4/5, clarity 4/5, completeness 4/5. How we work
Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake