KB5121575: Security update for Exchange Server 2019 CU14, August 2026. Critical Exchange privilege flaw covered; CU14 ESU ends in October

A critical Exchange privilege flaw is addressed. CU14 security updates are available only to ESU organizations through October 31, 2026.

Does it affect you? Applies to: Organizations running Exchange Server 2019 CU14 that are enrolled in the Period 2 Extended Security Update (ESU) program. Exchange Server 2019 is out of support; this update is available only to ESU organizations.

Review notes Additional details from the official release notes (1) Read note

Known issues The article gives the Test-Path command to check whether the module is present and does not specify an administrator-shell requirement.

The official sources are linked at the end of the page.

For servers running Cumulative Update 14: each cumulative update gets its own update. Support for this version ended on October 14, 2025: Microsoft releases this update only to organizations enrolled in the Extended Security Update (ESU) program, not through Microsoft Update. The others should move to Exchange Server Subscription Edition. Which version am I on?

What changes

Fix 1 change

Exchange Server

The update addresses vulnerabilities in Exchange Server.¹
Applies to Exchange Server 2019 CU14.

Known issues

Open Affects: Organizations and IT administrators

Published calendar (.ics) returns HTTP 500 for calendar applications

On Exchange Subscription Edition build 15.2.2562.46, anonymous calendar subscriptions can fail with HTTP 500. For CU14, the article lists KB5128897 as the fix.²

How to apply the workaround IIS / URL Rewrite

The rule adds layout=premium to calendar requests that lack a layout parameter. This selects the supported code path and restores the calendar feed.²
Step-by-step instructions, command & download kit
4 steps powershell.exe · Administrator Instructions (.txt)

Show steps & kit Hide steps & kit
Step-by-step procedure
1. Check that the IIS URL Rewrite module is installed.
2. Add the inbound rule to the Exchange Back End site only, on every server serving the published calendar.
3. Match ^owa/calendar/.+\.ics$. If the query string does not already contain layout=, rewrite to {R:0}?layout=premium&{QUERY_STRING} and clear Append query string.
4. No application pool recycle is required.
powershell.exe · Administrator

> Test-Path "$env:windir\System32\inetsrv\rewrite.dll"
Open Affects: Organizations and IT administrators

Wrapper messages appear in shared mailbox in hybrid environments after installing the June 2026 Security Update

In hybrid setups, messages sent as or on behalf of a shared mailbox might also arrive in its Inbox as wrapper attachments. KB5121610 or later fixes this for CU14.³

Workaround status No workaround yet

Microsoft has not published a manual workaround for this issue yet. Monitor release health until a resolving update is available.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released: 2026-08-11
Classification: Security Updates
Type: Cumulative update
Servicing branch: CU14
Replaces: KB5103214
Replaced by: KB5121610

Version	Build	Channel
2019	15.2.1544.44	General availability

Security

7 vulnerabilities fixed

1 critical 6 important

Vulnerability	Severity	CVSS
CVE-2026-62911 Microsoft Exchange Server Elevation of Privilege Vulnerability	Critical	8.0
CVE-2026-62913 Microsoft Exchange Server Remote Code Execution Vulnerability	Important	8.8
CVE-2026-62914 Microsoft Exchange Server Spoofing Vulnerability	Important	7.3
CVE-2026-62910 Microsoft Exchange Server Elevation of Privilege Vulnerability	Important	7.2
CVE-2026-62912 Microsoft Exchange Server Denial of Service Vulnerability	Important	6.5
CVE-2026-62915 Microsoft Exchange Server Security Feature Bypass Vulnerability	Important	6.5
CVE-2026-65813 Microsoft Exchange Server Elevation of Privilege Vulnerability	Important	6.5

Updated components

1,014 files changed since the previous update for the same versions.

Top changed components	Files
Management and PowerShell	130
Transport	93
Client access (POP, IMAP, ActiveSync)	33
Mailbox replication	33
Search	27
Compliance and eDiscovery	26
Exchange Web Services and Autodiscover	17
Outlook on the web	8
Setup	8

Sources

Updated Nov 6, 2026

Cited passages from Microsoft's official notes (3)

1. This security update resolves vulnerabilities in Microsoft Exchange Server. support.microsoft.com
2. Add one URL Rewrite rule to the Exchange Back End site in IIS. The rule appends layout=premium to .ics requests below /owa/calendar/. This action selects the supported code path, and restores the feed. support.microsoft.com
3. Description of the security update for Microsoft Exchange Server 2019 CU14: September 8, 2026 (KB5121610) support.microsoft.com

Checked automatically: 8 of 8 checks passed, 3 quoted passages · compared with Microsoft's page on Oct 16, 2026

Quotes found in the official pages: passed
Numbers found in the sources: passed
Vulnerabilities from the dossier only: passed
Links to allowed domains only: passed
Every official change covered: passed
Readable plain text: passed
Changes confirmed by the file list: passed
Sources agree: passed

A second AI read the text against the sources: correctness 4/5, clarity 3/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake