#emailsecurity

Read Time:3 Minute, 21 Second

Microsoft has confirmed that security updates released for Windows Server on October 13 can interfere with on-premises Exchange Server operations. Affected organizations may see Outlook on the web become unavailable, messages remain in users’ Outboxes, and mail queues grow as database connectivity falters.

The problem can affect Exchange Server 2016, Exchange Server 2019, and Exchange Server Subscription Edition. Microsoft has provided a registry workaround and explicitly advises administrators not to remove the Windows security updates. The company currently describes the issue as mitigated while its investigation continues.

The operating system update is the triggerThis incident is easy to misdiagnose because it coincides with Microsoft’s October Exchange security releases. However, the confirmed cause is a change delivered through Windows Server updates, not the separate Exchange patches. An Exchange host may therefore experience the failure even if the latest Exchange-specific update has not been installed.

Microsoft has linked the behavior to four Windows packages: KB5126646 for Windows Server 2025, KB5126655 for Windows Server 2022, KB5126651 for Windows Server 2019, and KB5126868 for Windows Server 2016. Impact varies by workload, so two apparently similar servers may behave differently and some systems may never show symptoms.

The updates introduced a default ceiling of 512 simultaneous Endpoint Lookup calls. Endpoint Mapper supports remote procedure call communications, and the limit is intended to constrain memory consumption. Busy Exchange environments can exceed that allowance, causing dependent services and database communications to fail.

Symptoms administrators may encounterFor end users, the most visible sign is an inability to authenticate to Outlook on the web. Outlook clients may appear to send messages while leaving them stuck locally. Behind the scenes, administrators can encounter expanding transport queues, mailbox access failures during replication, or Database Availability Group members that cannot maintain quorum.

Restarting a server may temporarily restore operation, but it does not address the underlying capacity limit. Affected hosts can also log Application Event ID 1006. Another useful diagnostic clue is the error MapiExceptionMdbOffline, accompanied by a message that the client cannot connect to the server and the values hr=0x80004005 and ec=1142.

Because these indicators overlap with other Exchange outages, response teams should correlate the timing of the first failures with Windows update installation and inspect all members of a high-availability group. A partial failure can create confusing symptoms when traffic is redirected among healthy and unhealthy nodes.

Microsoft’s registry mitigationMicrosoft’s Exchange guidance raises the Endpoint Mapper saved-context capacity. From an elevated Command Prompt on each affected Exchange server, administrators can run the following command:

reg add "HKLM\SOFTWARE\Microsoft\Rpc" /v EpmapSavedContextCap /t REG_DWORD /d 65536 /f

The server must be restarted after applying the change. Microsoft says this adjustment has resolved the problem in customer environments it has handled. If failures recur, the company advises increasing the limit further, although its public guidance does not specify a universal second value. Organizations needing an additional mitigation can contact Microsoft Support.

Confirm the affected Windows update and document when symptoms began.

Apply the registry change through normal change-control procedures.

Restart one server at a time where resilient Exchange architecture permits it.

Monitor mail queues, database replication, DAG quorum, webmail access, and Event ID 1006.

Escalate recurring failures to Microsoft rather than repeatedly rebooting production hosts.

Keep the security fixes in placeUninstalling a security update can restore old, vulnerable code and should not be the default response to an availability problem. Microsoft’s position is to retain the October Windows updates and use the mitigation while engineering work continues. Administrators should also avoid assuming that installing or removing the separate Exchange update will solve this particular fault.

The timing adds pressure for organizations still operating Exchange 2016 or 2019. October 2026 is their final scheduled Extended Security Update release, while future routine security servicing is focused on Exchange Server Subscription Edition. Teams troubleshooting the outage should use the incident as an opportunity to confirm support status, patch governance, tested rollback plans, and a migration path for aging deployments.

Read Time:3 Minute, 49 Second

Microsoft has released a second version of its September 2026 Exchange Server security updates after identifying an additional authorization vulnerability that can expose mailboxes inside an organization. Administrators who installed the original September packages should not assume they are fully protected: the newly issued V2 updates add the fix for CVE-2026-96940.

The vulnerability carries a CVSS score of 8.8 and affects on-premises Exchange deployments. An attacker must already have authenticated access, but successful exploitation could allow that account to reach another user’s mailbox and obtain messages or attachments. The weakness requires no user interaction and is described as improper or insufficient authorization over a network.

Microsoft discovered the issue internally and says it is not aware of active exploitation. The reported access remains within the same organization rather than crossing Microsoft 365 tenant boundaries. Even with those limitations, mailbox contents routinely include sensitive business discussions, credentials, recovery links and attachments that could help an attacker deepen an intrusion.

Why the V2 designation mattersThe revised release adds protection that was not included in the original September security update. Organizations that patched earlier in the month therefore need to review their Exchange estate again and deploy the package matching each installed product and cumulative-update level.

Updates are available for Exchange Server Subscription Edition RTM, Exchange Server 2019 CU14 and CU15, and Exchange Server 2016 CU23. Administrators should verify the precise build before installation rather than applying a package intended for another cumulative update. Microsoft released the fix ahead of its planned schedule, so some supporting documentation may have lagged behind the packages when they first appeared.

CVE-2026-96940 is separate from CVE-2026-62911, an earlier Exchange issue associated with a demonstrated authentication-relay path. Public proof-of-concept material for the older bug is not evidence that exploit code exists for the new authorization flaw. Keeping the two vulnerabilities distinct is important for accurate detection and remediation.

Legacy Exchange versions require special attentionExchange Server 2016 and 2019 are outside their normal support periods. Their latest security fixes are available only to organizations enrolled in Microsoft’s Period 2 Extended Security Update program, which covers May through October 2026 and requires a separate purchase even for customers that joined an earlier ESU phase.

Microsoft says there will be no extension beyond October, making migration planning urgent for organizations still relying on those releases. Moving to Exchange Server Subscription Edition provides a supported path for continued security updates, but migrations must account for integrations, compliance requirements and hybrid identity dependencies.

Exchange Online customers are already protected from the vulnerabilities addressed by this release. Hybrid customers still have work to do: any local Exchange server must be updated, including servers retained only for recipient management. Systems with Exchange Management Tools also require the applicable updates. A lightly used management server remains part of the attack surface.

A safe patching sequenceExchange updates are cumulative, so a server on a supported cumulative update does not need every earlier security update installed one by one. Administrators can use Microsoft’s Exchange Update Wizard to identify the correct route and the Exchange Server Health Checker script to find missing cumulative updates, security packages and required manual actions.

A practical rollout should include:

Inventorying every production, disaster-recovery, hybrid-management and tools-only Exchange system.

Confirming the installed version and cumulative update before selecting the V2 package.

Backing up configuration and validating recovery procedures before maintenance.

Installing the update, restarting the server and checking that Exchange services return normally.

Running Health Checker again and reviewing event, authentication and mailbox-access logs.

Organizations should also monitor for unusual access from already authenticated accounts, because the flaw’s prerequisite means a compromised user could potentially abuse permissions without sending a malicious attachment. Strong multifactor authentication and careful session monitoring reduce the chance of obtaining the initial account but do not replace the server fix.

Known issues should not delay risk decisionsMicrosoft lists known problems involving published calendar files returning HTTP 500 responses and ContentEngine deadlocks affecting Korean-language email. Future updates are expected to address those issues. The release also includes corrections involving shared-mailbox wrapper messages and delegated-mailbox availability in some hybrid configurations.

Administrators should test the package against their operational requirements and watch service health closely after deployment. For most affected organizations, the priority is to close the cross-mailbox authorization gap promptly while following a controlled change process. The central lesson is simple: installing the first September update is not enough; protection against CVE-2026-96940 requires the revised V2 release.