KB5129955: Security update for Exchange Server Subscription Edition RTM, October 2026. Exchange vulnerabilities patched; hybrid free/busy times corrected

What changes

Known issues

1. Open Affects: Organizations and IT administrators

   Published calendar (.ics) returns HTTP 500 for calendar applications

   The KB lists published calendar subscriptions returning HTTP 500. The calendar app cannot refresh the subscription.³

   How to apply the workaround IIS / URL Rewrite

   Add a URL Rewrite rule to the Exchange Back End site on every server serving the calendar. Remove the rule after installing KB5128895 or later.³

   Step-by-step workaround instructions

   6 steps

   Show steps Hide steps

   Step-by-step procedure

   1. Confirm the IIS URL Rewrite module is installed; adding a rewrite section without it can cause HTTP 500.19 for the Exchange Back End site.
   2. In IIS Manager, add an inbound blank rule to the Exchange Back End site only. Do not apply it to Default Web Site or at server level.
   3. Match ^owa/calendar/.+\.ics$. Add a condition for {QUERY_STRING} that does not match (^|&)layout=.
   4. Rewrite to {R:0}?layout=premium&{QUERY_STRING}, clear Append query string, and select Stop processing of subsequent rules.
   5. Apply and verify the rule on every server that serves the published calendar.
   6. After installing KB5128895 or later, remove the rule in IIS Manager or delete its <rewrite> block. Check both C:\Windows\System32\inetsrv\config\applicationHost.config and %ExchangeInstallPath%\ClientAccess\web.config. No restart is required.
2. Open Affects: Organizations and IT administrators

   Availability (free/busy) fails for delegated mailboxes in Exchange hybrid deployments using Graph API only

   The KB lists Graph-only delegated free/busy failures, but Microsoft says the service issue is fixed.⁴

   How to apply the workaround Exchange Management Shell

   If the override is set to Enabled=False or was previously disabled, set it to Enabled=True and refresh the configuration.⁴

   Step-by-step instructions, command & download kit

   2 steps Exchange Management Shell Instructions (.txt)

   Show steps & kit Hide steps & kit

   Step-by-step procedure

   1. Check the current override value. Only re-enable it if it is set to Enabled=False or was previously disabled.
   2. Run the refresh command to apply the change immediately.

   Exchange Management Shell Copy

   > Get-SettingOverride -Identity EnableRouteThroughMSGraphFeature> Set-SettingOverride -Identity EnableRouteThroughMSGraphFeature -Parameters "Enabled=True"> Get-ExchangeDiagnosticInfo -Process Microsoft.Exchange.Directory.TopologyService -Component VariantConfiguration -Argument Refresh

   Instructions only (.txt) Safe plain-text steps & commands
3. Open Affects: Organizations and IT administrators

   A ContentEngine deadlock occurs because of missing Korean WordBreaker rule files

   The KB lists a deadlock linked to missing Korean WordBreaker files. Search results might be missing, mail delivery might be delayed, or Outlook might stall or disconnect.⁵

   Workaround status No workaround yet

   Microsoft has not published a manual workaround for this issue yet. Monitor release health until a resolving update is available.

Technical details

Sources

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake