KB5121574: Security update for Exchange Server 2019 CU15, August 2026. Critical privilege-escalation flaw in the mail server addressed

A critical flaw could let attackers gain higher privileges on the mail server. Only organizations enrolled in the Extended Security Update program can receive this release.

Does it affect you? Applies to: Organizations enrolled in Period 2 Extended Security Updates and running Exchange Server 2019 CU15.

Review notes Additional details from the official release notes (3) Read notes

Known issues KB5121609 or a later update fixes the wrapper-message issue on Exchange Server 2019 CU15.
Known issues KB5128896 or a later update fixes this issue on Exchange Server 2019 CU15; KB5128895 or later fixes it on Exchange Server Subscription Edition.
In detail KB5121574 was superseded by KB5121609.

The official sources are linked at the end of the page.

For servers running Cumulative Update 15: each cumulative update gets its own update. Support for this version ended on October 14, 2025: Microsoft releases this update only to organizations enrolled in the Extended Security Update (ESU) program, not through Microsoft Update. The others should move to Exchange Server Subscription Edition. Which version am I on?

What changes

Fix 1 change

Exchange Server

A critical flaw could let attackers gain higher privileges on the mail server.¹
Resolves security vulnerabilities in Exchange Server, including CVE-2026-62911, an elevation-of-privilege vulnerability.

Known issues

Open Affects: Organizations and IT administrators

Published calendar (.ics) returns HTTP 500 for calendar applications

After the August 2026 security update on Exchange Server Subscription Edition build 15.2.2562.46, some calendar subscriptions might stop refreshing. Calendar apps might report a server error, and the calendar URL might return HTTP 500.²

How to apply the workaround IIS / URL Rewrite

The rule adds layout=premium to calendar feed requests, selecting a supported code path that restores the feed.²
Step-by-step instructions, command & download kit
5 steps powershell.exe · Administrator Instructions (.txt)

Show steps & kit Hide steps & kit
Step-by-step procedure
1. Check that the IIS URL Rewrite module is installed. If it is not installed, do not add a <rewrite> section to applicationHost.config.
2. Add the rule to the Exchange Back End site only, not to Default Web Site or at server level.
3. Match the URL pattern ^owa/calendar/.+\.ics$ and add a condition so requests that already have a layout parameter are left alone.
4. Rewrite the URL as {R:0}?layout=premium&{QUERY_STRING}. Clear Append query string and enable Stop processing of subsequent rules.
5. Apply the rule on every server that serves the published calendar, then verify it and recheck it after Exchange updates.
powershell.exe · Administrator

> Test-Path "$env:windir\System32\inetsrv\rewrite.dll"
Open Affects: Organizations and IT administrators

Wrapper messages appear in shared mailbox in hybrid environments after installing the June 2026 Security Update

In some hybrid setups, sent messages might also arrive in the shared mailbox Inbox as attachments with a wrapper message.³

Workaround status No workaround yet

Microsoft has not published a manual workaround for this issue yet. Monitor release health until a resolving update is available.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released: 2026-08-11
Classification: Security Updates
Type: Cumulative update
Servicing branch: CU15
Replaces: KB5103213
Replaced by: KB5121609

Version	Build	Channel
2019	15.2.1748.49	General availability

Security

7 vulnerabilities fixed

1 critical 6 important

Vulnerability	Severity	CVSS
CVE-2026-62911 Microsoft Exchange Server Elevation of Privilege Vulnerability	Critical	8.0
CVE-2026-62913 Microsoft Exchange Server Remote Code Execution Vulnerability	Important	8.8
CVE-2026-62914 Microsoft Exchange Server Spoofing Vulnerability	Important	7.3
CVE-2026-62910 Microsoft Exchange Server Elevation of Privilege Vulnerability	Important	7.2
CVE-2026-62912 Microsoft Exchange Server Denial of Service Vulnerability	Important	6.5
CVE-2026-62915 Microsoft Exchange Server Security Feature Bypass Vulnerability	Important	6.5
CVE-2026-65813 Microsoft Exchange Server Elevation of Privilege Vulnerability	Important	6.5

Updated components

1,006 files changed since the previous update for the same versions.

Top changed components	Files
Management and PowerShell	120
Transport	93
Client access (POP, IMAP, ActiveSync)	33
Mailbox replication	33
Search	27
Compliance and eDiscovery	25
Exchange Web Services and Autodiscover	17
Outlook on the web	8
Setup	8

Sources

Updated Nov 7, 2026

Cited passages from Microsoft's official notes (3)

1. This security update resolves vulnerabilities in Microsoft Exchange Server. support.microsoft.com
2. After you install the August 2026 security update (Exchange Server SE, build 15.2.2562.46), subscriptions to an anonymously published Exchange calendar stop refreshing. support.microsoft.com
3. messages that are Sent As, or Sent on Behalf of, the shared mailbox may also be delivered to the Inbox folder of the shared mailbox as attachments support.microsoft.com

Checked automatically: 8 of 8 checks passed, 3 quoted passages · compared with Microsoft's page on Oct 16, 2026

Quotes found in the official pages: passed
Numbers found in the sources: passed
Vulnerabilities from the dossier only: passed
Links to allowed domains only: passed
Every official change covered: passed
Readable plain text: passed
Changes confirmed by the file list: passed
Sources agree: passed

A second AI read the text against the sources: correctness 3/5, clarity 4/5, completeness 3/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake