Skip to the content
The Update Bureau
Exchange Server 2016 CU23 Exchange Server 2016 CU23 ESU only Security update
Patch Tuesday

KB5121576

KB5121576: Security update for Exchange Server 2016 CU23, August 2026. Critical mailbox privilege flaw; shared-mailbox wrappers persist

In short

A critical elevation-of-privilege flaw in Exchange is fixed. Two known issues remain, including wrapper messages in shared mailboxes in hybrid setups.

Does it affect you? Applies to: Exchange Server 2016 CU23 organizations enrolled in the Period 2 Extended Security Update program. Exchange Server 2016 is out of support.

Build
15.1.2507.72
Servicing branch
CU23
Security
7 fixed · 1 critical
Review notes Additional details from the official release notes (4) Read notes
  • This page The update addresses a critical Exchange Server elevation-of-privilege vulnerability.
  • In detail The issue affects subscriptions to anonymously published Exchange calendars.
  • Known issues This can occur in a hybrid setup when an on-premises mailbox has permission to send as or on behalf of an Exchange Online shared mailbox, and the relevant message-copy setting is enabled.
  • Known issues The issue affects subscriptions to anonymously published Exchange calendars.

The official sources are linked at the end of the page.

For servers running Cumulative Update 23: each cumulative update gets its own update. Support for this version ended on October 14, 2025: Microsoft releases this update only to organizations enrolled in the Extended Security Update (ESU) program, not through Microsoft Update. The others should move to Exchange Server Subscription Edition. Which version am I on?

In detail

  • Security Fixes 7 vulnerabilities, including 1 critical: CVE-2026-62911, an Exchange Server elevation-of-privilege flaw.1
  • Known issues In some hybrid setups, sent messages may also arrive in a shared mailbox as attachments with wrapper text. KB5121611 or later resolves this for Exchange Server 2016 CU23.2
  • Known issues Calendar subscriptions may stop refreshing and return HTTP 500. KB5128898 or later resolves this for Exchange Server 2016 CU23.3
  • Lifecycle Only organizations enrolled in Period 2 ESU can receive security updates through the end of October 2026. Other organizations should migrate to Exchange Server Subscription Edition.4

Known issues

  1. Open Affects: Organizations and IT administrators

    Published calendar (.ics) returns HTTP 500 for calendar applications

    After the August 2026 security update, calendar subscriptions may stop refreshing and return HTTP 500 on Exchange Server Subscription Edition build 15.2.2562.46. KB5128898 or later resolves this for Exchange Server 2016 CU23.3

    How to apply the workaround IIS / URL Rewrite

    Add a URL Rewrite rule to the Exchange Back End site in IIS. Apply it on every server that serves the published calendar.3

    Step-by-step workaround instructions
    6 steps
    Show steps Hide steps
    Step-by-step procedure
    1. Confirm the IIS URL Rewrite module is installed; Exchange Server Setup does not install it.
    2. In IIS Manager, open Sites > Exchange Back End > URL Rewrite.
    3. Add a blank inbound rule named OWA published calendar force premium layout. Match ^owa/calendar/.+\.ics$ using regular expressions and ignore case.
    4. Add a condition for {QUERY_STRING} that does not match (^|&)layout=.
    5. Set the rewrite URL to {R:0}?layout=premium&{QUERY_STRING}. Clear Append query string and select Stop processing of subsequent rules.
    6. Apply the rule only to Exchange Back End, on each server serving the calendar. No application pool recycle is required.
  2. Open Affects: Organizations and IT administrators

    Wrapper messages appear in shared mailbox in hybrid environments after installing the June 2026 Security Update

    In hybrid setups with an Exchange Online shared mailbox, sent-as or sent-on-behalf messages may also arrive in its Inbox as attachments with wrapper text. KB5121611 or later resolves this for Exchange Server 2016 CU23.2

    Workaround status No workaround yet

    Microsoft has not published a manual workaround for this issue yet. Monitor release health until a resolving update is available.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2026-08-11
Classification
Security Updates
Type
Cumulative update
Servicing branch
CU23
Replaces
KB5103215
Replaced by
KB5121611
VersionBuildChannel
2016 15.1.2507.72 General availability

Security

7 vulnerabilities fixed
1 critical 6 important
VulnerabilitySeverityCVSS
CVE-2026-62911
Microsoft Exchange Server Elevation of Privilege Vulnerability
 Critical 8.0
CVE-2026-62913
Microsoft Exchange Server Remote Code Execution Vulnerability
 Important 8.8
CVE-2026-62914
Microsoft Exchange Server Spoofing Vulnerability
 Important 7.3
CVE-2026-62910
Microsoft Exchange Server Elevation of Privilege Vulnerability
 Important 7.2
CVE-2026-62912
Microsoft Exchange Server Denial of Service Vulnerability
 Important 6.5
CVE-2026-62915
Microsoft Exchange Server Security Feature Bypass Vulnerability
 Important 6.5
CVE-2026-65813
Microsoft Exchange Server Elevation of Privilege Vulnerability
 Important 6.5

Updated components

1,011 files changed since the previous update for the same versions.

Top changed componentsFiles
Management and PowerShell118
Transport94
Client access (POP, IMAP, ActiveSync)33
Mailbox replication33
Search27
Compliance and eDiscovery26
Exchange Web Services and Autodiscover17
Outlook on the web8
Setup8

Sources

Updated
Cited passages from Microsoft's official notes (4)
  1. 1. This security update resolves vulnerabilities in Microsoft Exchange Server. support.microsoft.com
  2. 2. After you install the June 2026 Security Update (SU) for Exchange Server, messages that are Sent As, or Sent on Behalf of, the shared mailbox may also be delivered to the Inbox folder of the shared mailbox as attachments support.microsoft.com
  3. 3. After you install the August 2026 security update (Exchange Server SE, build 15.2.2562.46), subscriptions to an anonymously published Exchange calendar stop refreshing. support.microsoft.com
  4. 4. Organizations that are enrolled in the Period 2 Extended Security Update (ESU) program are eligible to receive released security updates until the end of October 2026. support.microsoft.com
Checked automatically: 8 of 8 checks passed, 4 quoted passages · compared with Microsoft's page on Oct 16, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: passed

A second AI read the text against the sources: correctness 3/5, clarity 3/5, completeness 4/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake