Skip to the content
The Update Bureau
Exchange Server Subscription Edition RTM Exchange Server Subscription Edition RTM Security update
Patch Tuesday

KB5133453

KB5133453: Security update for Exchange Server Subscription Edition RTM, November 2026. Critical mail-server flaw patched; hybrid free/busy corrected

In short

A critical remote-code flaw in Exchange is patched. Hybrid users can also see correct free/busy details in classic Outlook.

Does it affect you? Applies to: Exchange Server Subscription Edition RTM on x64, updated to build 15.2.2562.57.

Build
15.2.2562.57
Servicing branch
RTM
Security
9 fixed · 1 critical

What changes

Fixes 2 changes

Free/busy availability

  • On-premises users in hybrid setups can see correct free/busy details for Exchange Online mailboxes in classic Outlook.1
    The issue affected hybrid environments with Microsoft Graph API enabled.

Server stability

Verified in package
  • Exchange server instability after the October 2026 Windows Server updates is resolved by installing the November 2026 Windows Server update.2
    The issue could cause Outlook on the web failures, growing mail queues, delayed or stopped mail flow, and Database Availability Group members to lose communication or quorum.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2026-11-10
Classification
Security Updates
Type
Cumulative update
Servicing branch
RTM
Replaces
KB5128895, KB5129955, KB5121608
VersionBuildChannel
SE 15.2.2562.57 General availability

Security

9 vulnerabilities fixed
1 critical 8 important
VulnerabilitySeverityCVSS
CVE-2026-118207
Microsoft Exchange Server Remote Code Execution Vulnerability
 Critical 8.8
CVE-2026-118149
Microsoft Exchange Server Remote Code Execution Vulnerability
 Important 8.8
CVE-2026-118150
Microsoft Exchange Server Elevation of Privilege Vulnerability
 Important 8.8
CVE-2026-118154
Microsoft Exchange Server Elevation of Privilege Vulnerability
 Important 8.8
CVE-2026-118153
Microsoft Exchange Server Denial of Service Vulnerability
 Important 7.5
CVE-2026-118151
Microsoft Exchange Server Elevation of Privilege Vulnerability
 Important 7.2
CVE-2026-118157
Microsoft Exchange Server Elevation of Privilege Vulnerability
 Important 7.2
CVE-2026-118208
Microsoft Exchange Server Spoofing Vulnerability
 Important 7.1
CVE-2026-118152
Microsoft Exchange Server Spoofing Vulnerability
 Important 6.5

Updated components

1,939 files changed since the previous update for the same versions.

Top changed componentsFiles
Management and PowerShell157
Transport93
Client access (POP, IMAP, ActiveSync)33
Mailbox replication33
Search27
Compliance and eDiscovery26
Exchange Web Services and Autodiscover17
Outlook on the web8
Setup8

Verified in package: changed files confirm Server stability.

Page history

  1. Now also covers build 15.2.2562.57 (SE)

Sources

Updated
Cited passages from Microsoft's official notes (2)
  1. 1. To fix this issue, install the following security update or later updates: support.microsoft.com
  2. 2. To fix this issue, install the November 2026 update for Windows Server. support.microsoft.com
Checked automatically: 8 of 8 checks passed, 2 quoted passages · compared with Microsoft's page on Nov 15, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: passed

A second AI read the text against the sources: correctness 5/5, clarity 4/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake