Exchange updates (SU & CU)
Security updates (SU) and cumulative updates (CU) for Exchange Server in chronological order: closed vulnerabilities, installation pitfalls, and the follow-up work that comes after patch day.
NewExchange Outages After the October 2026 Windows Server Updates: MapiExceptionMdbOffline (ec=1142)
After the Windows Server updates of October 13, 2026, Exchange servers report MapiExceptionMdbOffline (ec=1142) after around 24 hours: OWA fails, queues grow, and DAG copies stop replicating. Microsoft confirms the link to the Windows updates, but a fix is not yet available. Symptoms, affected KBs, verification commands, and recommended steps.
NewOctober 2026 Exchange security updates: six vulnerabilities, final update for Exchange 2016 and 2019
The October SU closes six vulnerabilities, including a critical remote code execution issue through a crafted email, and fixes the .ics issue and the WordBreaker deadlock. It is the final update for Exchange 2016 and 2019, including under the ESU program.
Exchange Security Update September 2026 v2: Early Fix for CVE-2026-96940
On October 2, 2026, Microsoft released version 2 of the September SUs for Exchange SE, 2019, and 2016. It also addresses CVE-2026-96940, an elevation-of-privilege vulnerability with a CVSS score of 8.8 and an “Exploitation More Likely” assessment. Microsoft recommends installing v2 as soon as possible, including on servers running the first September SU.
September 2026 Exchange Security Updates: Nine Vulnerabilities, Wrapper Issue Fixed, v2 Released
The September SU closes nine vulnerabilities in Exchange SE and 2019 (eight in Exchange 2016), including a spoofing vulnerability with CVSS 9.3, and fixes the wrapper issue in hybrid environments. A v2 with an additional CVE followed on October 2; there are also three known issues with workarounds and a SettingOverride that should now be removed.
Exchange Online throttles and blocks outdated Exchange 2016 and 2019 servers starting in September 2026: How transport enforcement works
Starting in the second week of September 2026, Exchange Online requires hybrid servers to have at least the October 2025 SU; otherwise, mail flow is throttled and later blocked. Background on transport enforcement since 2023, escalation stages with SMTP codes, the report in the Admin Center, the 90-day pause via PowerShell, and why the next increase will only allow ESU customers and Exchange SE.
August 2026 Exchange Security Updates: Pwn2Own Vulnerability Fixed, OWA Light Disabled
The August SU fixes seven vulnerabilities, including the Exchange exploit demonstrated at Pwn2Own 2026, and permanently disables OWA Light. Microsoft also explains why Exchange SUs are now released monthly and why Exchange SE CU1 is still delayed.
Properly follow up on the July 2026 Exchange security updates
Two cleanup tasks are needed after installation: safely remove the old CVE-2026-42897 mitigation and review overprivileged legacy groups in Active Directory.
