Skip to the content
The Update Bureau
Exchange Server 2016 CU23 Exchange Server 2016 CU23 ESU only Security update
Patch Tuesday Final update for this version

KB5128898

KB5128898: Security update for Exchange Server 2016 CU23, October 2026. Critical remote-code flaw and published-calendar errors addressed

In short

Fixes six Exchange Server vulnerabilities, including one critical remote-code-execution flaw, and resolves an issue that stopped published calendar subscriptions from refreshing. It is available only to organizations enrolled in the Extended Security Update program.

Does it affect you? Applies to: Exchange Server 2016 CU23 organizations enrolled in the Period 2 Extended Security Update (ESU) program. Microsoft says Exchange Server 2016 has reached end of support; organizations outside the ESU program should migrate to Exchange Server Subscription Edition.

Build
15.1.2507.77
Servicing branch
CU23
Security
6 fixed · 1 critical

For servers running Cumulative Update 23: each cumulative update gets its own update. Support for this version ended on October 14, 2025: Microsoft releases this update only to organizations enrolled in the Extended Security Update (ESU) program, not through Microsoft Update. The others should move to Exchange Server Subscription Edition. Which version am I on?

What changes

Fixes 2 changes

Exchange Server

  • Exchange Server closes six security vulnerabilities, including a critical flaw that could allow remote code execution.1
    The vulnerabilities affect remote code execution (CVE-2026-70571), elevation of privilege (CVE-2026-77910, CVE-2026-87692, CVE-2026-87695, and CVE-2026-87696), and spoofing (CVE-2026-70279).

Published calendars

For: Organizations with published Exchange calendars

  • Subscriptions to anonymously published calendars refresh again instead of stopping with an HTTP 500 error.2
    The issue affected published Exchange calendar subscriptions using .ics URLs.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2026-10-13
Classification
Security Updates
Type
Cumulative update
Servicing branch
CU23
Replaces
KB5129958
VersionBuildChannel
2016 15.1.2507.77 General availability

Security

6 vulnerabilities fixed
1 critical 5 important
VulnerabilitySeverityCVSS
CVE-2026-70571
Microsoft Exchange Server Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-70279
Microsoft Exchange Server Spoofing Vulnerability
 Important 9.3
CVE-2026-77910
Microsoft Exchange Server Elevation of Privilege Vulnerability
 Important 8.8
CVE-2026-87692
Microsoft Exchange Server Elevation of Privilege Vulnerability
 Important 7.8
CVE-2026-87695
Microsoft Exchange Server Elevation of Privilege Vulnerability
 Important 7.8
CVE-2026-87696
Microsoft Exchange Server Elevation of Privilege Vulnerability
 Important 7.5

Updated components

1,011 files changed since the previous update for the same versions.

Top changed componentsFiles
Management and PowerShell121
Transport94
Client access (POP, IMAP, ActiveSync)33
Mailbox replication33
Search27
Compliance and eDiscovery26
Exchange Web Services and Autodiscover17
Outlook on the web8
Setup8

Sources

Updated
Cited passages from Microsoft's official notes (2)
  1. 1. This security update resolves vulnerabilities in Microsoft Exchange Server. support.microsoft.com
  2. 2. subscriptions to an anonymously published Exchange calendar stop refreshing. The subscribing application reports a server error, and the URL returns HTTP 500. support.microsoft.com
Checked automatically: 8 of 8 checks passed, 2 quoted passages · compared with Microsoft's page on Oct 20, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: passed

A second AI read the text against the sources: correctness 5/5, clarity 4/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake