Skip to the content
The Update Bureau
Exchange Server Subscription Edition RTM Exchange Server Subscription Edition RTM Security update
Patch Tuesday

KB5121573

KB5121573: Security update for Exchange Server Subscription Edition RTM, August 2026. Exchange privilege flaw addressed; published calendar feeds can fail

In short

A critical Exchange privilege-escalation flaw is addressed. Published calendar subscriptions might stop refreshing and return HTTP 500.

Does it affect you? Applies to: Exchange Server Subscription Edition RTM, x64, build 15.2.2562.46.

Build
15.2.2562.46
Servicing branch
RTM
Security
7 fixed · 1 critical
Review notes Additional details from the official release notes (2) Read notes
  • In short After installing this update, subscriptions to anonymously published Exchange calendars stop refreshing, and the calendar URL returns HTTP 500.
  • Known issues After installing this update, subscriptions to anonymously published Exchange calendars stop refreshing, and the URL returns an HTTP 500 server error.

The official sources are linked at the end of the page.

What changes

Fix 1 change

Exchange Server

  • The update addresses a critical flaw that could let an attacker gain higher privileges in Exchange Server.1
    CVE-2026-62911 is an elevation-of-privilege vulnerability.

Known issues

  1. Open Affects: Organizations and IT administrators

    Published calendar (.ics) returns HTTP 500 for calendar applications

    After this update, subscriptions to anonymously published Exchange calendars might stop refreshing. Calendar apps might receive an HTTP 500 error.2

    How to apply the workaround IIS / URL Rewrite

    Add a URL Rewrite rule to the Exchange Back End site. It adds layout=premium to calendar-feed requests that do not already have a layout parameter.2

    Step-by-step workaround instructions
    5 steps
    Show steps Hide steps
    Step-by-step procedure
    1. Confirm that the IIS URL Rewrite module is installed.
    2. In IIS Manager, add a blank inbound rule to the Exchange Back End site's URL Rewrite settings.
    3. Match ^owa/calendar/.+\.ics$ and add a condition that excludes requests whose query string already contains layout=.
    4. Rewrite the URL to {R:0}?layout=premium&{QUERY_STRING}; clear Append query string.
    5. Apply the rule on every server that serves the published calendar. No application pool recycle is required.
  2. Open Affects: Organizations and IT administrators

    Availability (free/busy) fails for delegated mailboxes in Exchange hybrid deployments using Graph API only

    In some Exchange hybrid setups, checking a delegated mailbox's availability might show an error or no details. This affects Graph API-only setups; Microsoft says the service fix is available.3

    How to apply the workaround Exchange Management Shell

    The override enables the Graph API route for availability checks. Refreshing Variant Configuration applies the change immediately.3

    Step-by-step instructions, command & download kit
    3 steps Exchange Management Shell Instructions (.txt)
    Show steps & kit Hide steps & kit
    Step-by-step procedure
    1. Check the current value of the override.
    2. Only if it is Enabled=False or was previously disabled, set it to Enabled=True.
    3. Run the refresh command to apply the change immediately.
    Exchange Management Shell 
    > Get-SettingOverride -Identity EnableRouteThroughMSGraphFeature> Set-SettingOverride -Identity EnableRouteThroughMSGraphFeature -Parameters "Enabled=True"> Get-ExchangeDiagnosticInfo -Process Microsoft.Exchange.Directory.TopologyService -Component VariantConfiguration -Argument Refresh
  3. Open Affects: Organizations and IT administrators

    Wrapper messages appear in shared mailbox in hybrid environments after installing the June 2026 Security Update

    In Exchange hybrid, sent messages might appear as attachments in an Exchange Online shared mailbox Inbox. With an on-premises sender, Send As or Send on Behalf rights, and message-copy enabled, this occurs; KB5121608 resolves it.4

    How to apply the workaround Exchange Management Shell

    The article says to remove the override if it was created as a workaround for this issue.4

    Step-by-step instructions, command & download kit
    2 steps Exchange Management Shell Instructions (.txt)
    Show steps & kit Hide steps & kit
    Step-by-step procedure
    1. In Exchange Management Shell, check whether the override exists.
    2. If it exists, remove it.
    Exchange Management Shell 
    > Get-SettingOverride "DisableBlockSharedAndUserMailboxHeaders"> Remove-SettingOverride "DisableBlockSharedAndUserMailboxHeaders"

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2026-08-11
Classification
Security Updates
Type
Cumulative update
Servicing branch
RTM
Replaces
KB5103212, KB5094139
Replaced by
KB5121608
VersionBuildChannel
SE 15.2.2562.46 General availability

Security

7 vulnerabilities fixed
1 critical 6 important
VulnerabilitySeverityCVSS
CVE-2026-62911
Microsoft Exchange Server Elevation of Privilege Vulnerability
 Critical 8.0
CVE-2026-62913
Microsoft Exchange Server Remote Code Execution Vulnerability
 Important 8.8
CVE-2026-62914
Microsoft Exchange Server Spoofing Vulnerability
 Important 7.3
CVE-2026-62910
Microsoft Exchange Server Elevation of Privilege Vulnerability
 Important 7.2
CVE-2026-62912
Microsoft Exchange Server Denial of Service Vulnerability
 Important 6.5
CVE-2026-62915
Microsoft Exchange Server Security Feature Bypass Vulnerability
 Important 6.5
CVE-2026-65813
Microsoft Exchange Server Elevation of Privilege Vulnerability
 Important 6.5

Updated components

1,004 files changed since the previous update for the same versions.

Top changed componentsFiles
Management and PowerShell123
Transport93
Client access (POP, IMAP, ActiveSync)33
Mailbox replication33
Search27
Compliance and eDiscovery24
Exchange Web Services and Autodiscover17
Outlook on the web8
Setup8

Sources

Updated
Cited passages from Microsoft's official notes (4)
  1. 1. - CVE-2026-62911 - Microsoft Common Vulnerabilities and Exposures support.microsoft.com
  2. 2. Add one URL Rewrite rule to the Exchange Back End site in IIS. The rule appends layout=premium to .ics requests below /owa/calendar/. support.microsoft.com
  3. 3. If it is set to Enabled=False, or if you had previously disabled the override, re-enable it by setting it to Enabled=True using the following command: support.microsoft.com
  4. 4. messages that are Sent As, or Sent on Behalf of, the shared mailbox may also be delivered to the Inbox folder of the shared mailbox as attachments support.microsoft.com
Checked automatically: 8 of 8 checks passed, 4 quoted passages · compared with Microsoft's page on Oct 16, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: passed

A second AI read the text against the sources: correctness 4/5, clarity 3/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake