Skip to the content
The Update Bureau
Exchange Server Subscription Edition RTM Exchange Server Subscription Edition RTM Security update
Patch Tuesday

KB5121608

KB5121608: Security update for Exchange Server Subscription Edition RTM, September 2026. Exchange vulnerabilities addressed; published calendar feeds may fail

In short

Security flaws are addressed, but published calendar feeds and Korean-content processing have known issues.

Does it affect you? Applies to: Exchange Server Subscription Edition RTM on x64 devices. This update installs build 15.2.2562.49.

Build
15.2.2562.49
Servicing branch
RTM
Security
9 fixed

What changes

Fixes 2 changes

Shared mailboxes

Verified in package

For: Exchange hybrid environments

  • In the hybrid setup described in the issue article, wrapper messages no longer appear in shared mailbox inboxes.1
    Resolves the issue where messages sent as or on behalf of an Exchange Online shared mailbox could also arrive in its Inbox as attachments.

Free/busy

For: Exchange hybrid environments using Microsoft Graph

  • Hybrid free/busy results no longer shift busy times by the requester's time zone in the scenario described.2
    Resolves incorrect Microsoft Graph-based free/busy intervals for an on-premises requester querying an Exchange Online mailbox.

Known issues

  1. Open Affects: Organizations and IT administrators

    Published calendar (.ics) returns HTTP 500 for calendar applications

    Microsoft lists published calendar subscriptions returning HTTP 500 for calendar applications as an open issue for this update. The linked article names KB5128895 or a later update as the resolution.3

    How to apply the workaround IIS / URL Rewrite

    The rule adds layout=premium to calendar requests that do not already have a layout parameter. This selects the supported code path and restores the calendar feed.3

    Step-by-step instructions, command & download kit
    6 steps powershell.exe · Administrator Instructions (.txt)
    Show steps & kit Hide steps & kit
    Step-by-step procedure
    1. Check that IIS URL Rewrite is installed by running the command below.
    2. In IIS Manager, add a blank inbound rule to the Exchange Back End site only; do not apply it to Default Web Site or at server level.
    3. Match ^owa/calendar/.+\.ics$ using case-insensitive regular expressions.
    4. Add a condition where {QUERY_STRING} does not match (^|&)layout=.
    5. Rewrite to {R:0}?layout=premium&{QUERY_STRING}, clear Append query string, and select Stop processing of subsequent rules.
    6. Apply and verify the rule on every server serving published calendars.
    powershell.exe · Administrator 
    > Test-Path "$env:windir\System32\inetsrv\rewrite.dll"
  2. Open Affects: Organizations and IT administrators

    Availability (free/busy) fails for delegated mailboxes in Exchange hybrid deployments using Graph API only

    In Graph API-only hybrid deployments, delegated mailbox users might not see free/busy details for Exchange Online mailboxes. Microsoft lists the issue for this update; the linked article says the service issue is fixed.4

    How to apply the workaround Exchange Management Shell

    Check the override and set it to Enabled=True only if it is disabled or was previously disabled. Then refresh Variant Configuration.4

    Step-by-step instructions, command & download kit
    3 steps Exchange Management Shell Instructions (.txt)
    Show steps & kit Hide steps & kit
    Step-by-step procedure
    1. Check the current value of the override.
    2. If it is set to Enabled=False, or it was previously disabled, set it to Enabled=True.
    3. Run the refresh command to apply the change immediately.
    Exchange Management Shell 
    > Get-SettingOverride -Identity EnableRouteThroughMSGraphFeature> Set-SettingOverride -Identity EnableRouteThroughMSGraphFeature -Parameters "Enabled=True"> Get-ExchangeDiagnosticInfo -Process Microsoft.Exchange.Directory.TopologyService -Component VariantConfiguration -Argument Refresh
  3. Open Affects: Organizations and IT administrators

    A ContentEngine deadlock occurs because of missing Korean WordBreaker rule files

    After this update, Korean-content processing might cause missing search results, delayed email, or unresponsive Outlook clients. Microsoft lists it as an open issue for this update; the linked article names KB5128895 or a later update as the resolution.5

    Workaround status No workaround yet

    Microsoft has not published a manual workaround for this issue yet. Monitor release health until a resolving update is available.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2026-09-08
Classification
Security Updates
Type
Cumulative update
Servicing branch
RTM
Replaces
KB5121573, KB5103212
Replaced by
KB5129955
VersionBuildChannel
SE 15.2.2562.49 General availability

Security

9 vulnerabilities fixed
9 important
VulnerabilitySeverityCVSS
CVE-2026-69356
Microsoft Exchange Server Spoofing Vulnerability
 Important 9.3
CVE-2026-69641
Microsoft Exchange Server Elevation of Privilege Vulnerability
 Important 9.1
CVE-2026-69355
Microsoft Exchange Server Remote Code Execution Vulnerability
 Important 8.8
CVE-2026-55007
Microsoft Exchange Server Remote Code Execution Vulnerability
 Important 8.1
CVE-2026-69380
Microsoft Exchange Server Elevation of Privilege Vulnerability
 Important 8.1
CVE-2026-69378
Microsoft Exchange Server Denial of Service Vulnerability
 Important 7.5
CVE-2026-69361
Microsoft Exchange Server Spoofing Vulnerability
 Important 6.5
CVE-2026-69375
Microsoft Exchange Server Tampering Vulnerability
 Important 6.5
CVE-2026-69382
Microsoft Exchange Server Information Disclosure Vulnerability
 Important 5.9

Updated components

1,175 files changed since the previous update for the same versions.

Top changed componentsFiles
Management and PowerShell121
Transport93
Client access (POP, IMAP, ActiveSync)33
Mailbox replication33
Search27
Compliance and eDiscovery26
Exchange Web Services and Autodiscover17
Outlook on the web8
Setup8

Verified in package: changed files confirm Shared mailboxes.

Sources

Updated
Cited passages from Microsoft's official notes (5)
  1. 1. Description of the security update for Microsoft Exchange Server Subscription Edition RTM: September 8, 2026 (KB5121608) support.microsoft.com
  2. 2. To fix this issue, install the following security update or later updates: support.microsoft.com
  3. 3. Description of the security update for Microsoft Exchange Server Subscription Edition RTM October 13, 2026 (KB5128895) support.microsoft.com
  4. 4. The issue has been fixed in the service. support.microsoft.com
  5. 5. Description of the security update for Microsoft Exchange Server Subscription Edition RTM October 13, 2026 (KB5128895) support.microsoft.com
Checked automatically: 8 of 8 checks passed, 5 quoted passages · compared with Microsoft's page on Nov 8, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: passed

A second AI read the text against the sources: correctness 5/5, clarity 3/5, completeness 4/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake