KB5121611: Security update for Exchange Server 2016 CU23, September 2026. Eight security flaws addressed; published calendar feeds can fail

Addresses eight Important vulnerabilities and fixes wrapper messages appearing in shared mailboxes in hybrid deployments. Published calendar subscriptions can still return HTTP 500.

Does it affect you? Applies to: Exchange Server 2016 CU23 installations. Exchange Server 2016 is out of support, so this update is available only to organizations enrolled in the Period 2 Extended Security Update (ESU) program.

For servers running Cumulative Update 23: each cumulative update gets its own update. Support for this version ended on October 14, 2025: Microsoft releases this update only to organizations enrolled in the Extended Security Update (ESU) program, not through Microsoft Update. The others should move to Exchange Server Subscription Edition. Which version am I on?

What changes

Fix 1 change

Hybrid deployments

For: Hybrid Exchange deployments

In certain hybrid deployments, messages sent as or on behalf of an Exchange Online shared mailbox no longer might also arrive in its Inbox as wrapper-message attachments.¹
The issue affected organizations with an on-premises Exchange mailbox that had Send As or Send on Behalf permissions, when MessageCopyForSentAsEnabled or MessageCopyForSendOnBehalfEnabled was enabled. This update is listed as a resolution.

Known issues

Open Affects: Organizations and IT administrators

Published calendar (.ics) returns HTTP 500 for calendar applications

After the August 2026 security update on Exchange Server Subscription Edition build 15.2.2562.46, subscriptions to anonymously published calendars might stop refreshing and calendar applications might receive HTTP 500. This issue is associated with that earlier update, not this one. KB5128898 or a later update resolves it for Exchange Server 2016 CU23.²

How to apply the workaround IIS / URL Rewrite

The rule adds layout=premium to matching calendar-feed requests unless a layout parameter is already present. This selects the supported code path that restores the feed.²
Step-by-step instructions, command & download kit
5 steps powershell.exe · Administrator Instructions (.txt)

Show steps & kit Hide steps & kit
Step-by-step procedure
1. Check that the IIS URL Rewrite module is installed.
2. On each server serving the published calendar, add the rule to the Exchange Back End site only; do not apply it to Default Web Site or at server level.
3. Match ^owa/calendar/.+\.ics$ and leave requests with an existing layout= query parameter unchanged.
4. Rewrite the URL to {R:0}?layout=premium&{QUERY_STRING} and disable Append query string; in applicationHost.config, use appendQueryString="false".
5. Verify that the calendar feed returns HTTP 200 and text/calendar. No application pool recycle or restart is required.
powershell.exe · Administrator

> Test-Path "$env:windir\System32\inetsrv\rewrite.dll"

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released: 2026-09-08
Classification: Security Updates
Type: Cumulative update
Servicing branch: CU23
Replaces: KB5121576
Replaced by: KB5129958

Version	Build	Channel
2016	15.1.2507.73	General availability

Security

8 vulnerabilities fixed

8 important

Vulnerability	Severity	CVSS
CVE-2026-69356 Microsoft Exchange Server Spoofing Vulnerability	Important	9.3
CVE-2026-69641 Microsoft Exchange Server Elevation of Privilege Vulnerability	Important	9.1
CVE-2026-69355 Microsoft Exchange Server Remote Code Execution Vulnerability	Important	8.8
CVE-2026-69380 Microsoft Exchange Server Elevation of Privilege Vulnerability	Important	8.1
CVE-2026-69378 Microsoft Exchange Server Denial of Service Vulnerability	Important	7.5
CVE-2026-69361 Microsoft Exchange Server Spoofing Vulnerability	Important	6.5
CVE-2026-69375 Microsoft Exchange Server Tampering Vulnerability	Important	6.5
CVE-2026-69382 Microsoft Exchange Server Information Disclosure Vulnerability	Important	5.9

Updated components

1,084 files changed since the previous update for the same versions.

Top changed components	Files
Management and PowerShell	119
Transport	94
Client access (POP, IMAP, ActiveSync)	33
Mailbox replication	33
Search	27
Compliance and eDiscovery	26
Exchange Web Services and Autodiscover	17
Outlook on the web	9
Setup	8

Sources

Updated Oct 26, 2026

Cited passages from Microsoft's official notes (2)

1. To fix this issue, install the following security update or later updates for your version of Microsoft Exchange Server: support.microsoft.com
2. Add one URL Rewrite rule to the Exchange Back End site in IIS. The rule appends layout=premium to .ics requests below /owa/calendar/. support.microsoft.com

Checked automatically: 8 of 8 checks passed, 2 quoted passages · compared with Microsoft's page on Oct 20, 2026

Quotes found in the official pages: passed
Numbers found in the sources: passed
Vulnerabilities from the dossier only: passed
Links to allowed domains only: passed
Every official change covered: passed
Readable plain text: passed
Changes confirmed by the file list: passed
Sources agree: passed

A second AI read the text against the sources: correctness 5/5, clarity 4/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake