Microsoft has confirmed that the October 2026 Windows Server security updates can cause on-premises Exchange servers to become unstable. Since Patch Tuesday on October 13, admins have reported users unable to sign in to Outlook on the web (OWA), messages stuck in Outlook Outboxes, and mail queues grinding to a halt.

The problem affects Exchange Server 2016, 2019 and Subscription Edition (SE). It is not caused by the October 2026 Exchange Server security updates: any version of Exchange running on an affected version of Windows Server can be hit, whether or not the Exchange SU has been installed.

Symptoms

  • OWA fails with the error MapiExceptionMdbOffline: Unable to make connection to the server. (hr=0x80004005, ec=1142), with Event ID 1006 logged in the Application Log.
  • Email queues grow throughout the day until mail flow slows to a crawl.
  • Messages sent from Outlook remain in the Outbox and aren’t delivered.
  • DAG members fail to reach quorum, and Exchange has trouble accessing mailboxes during mailbox replication.
  • Rebooting the server may fix the problem, but only temporarily.

Not every server is affected equally. How quickly and severely the issue appears depends on server load, and some servers may never see it.

Affected Windows Server Updates

What’s Causing It

The October updates introduced a new default limit on the memory the RPC Endpoint Mapper can use when handling Endpoint Lookup calls. The default allows 512 simultaneous lookups, which isn’t enough for a busy Exchange server. Once the limit is reached, Exchange services start failing to connect.

How to Fix It

Microsoft recommends the following:

  1. Don’t uninstall the October Windows Server updates.
  2. From an elevated Command Prompt on each Exchange server, raise the Endpoint Mapper limit:
Administrator: Command Prompt
reg add "HKLM\SOFTWARE\Microsoft\Rpc" /v EpmapSavedContextCap /t REG_DWORD /d 65536 /f
  1. Reboot the server.
  2. Monitor the environment. If the issue comes back, raise the limit further.

For detailed steps see the official announcement.

Microsoft says this workaround has resolved the problem in the customer cases it has assisted with so far. An additional mitigation is available through Microsoft Support for business, and Microsoft is still investigating a permanent fix.

Fortify Your Server with Messageware Security

Data breaches have increased by 72%, servers are compromised in under 90 minutes. Ensure you have multiple layers of security software protecting your Windows Servers.

Server Threat Guard (STG) for All Windows Servers: Next-gen server protection, providing detection, alerting, and response (MDR) to zero-day and server penetration cyber-attacks. No need to research complicated deployments and no learning curve to install and manage.

EPG Guard for Exchange Servers: Real-time security. Stop AD account lockouts, eliminate password attacks, intelligent GEO blocking, and prevent Exchange Server vulnerability probing.

Don’t leave your critical infrastructure vulnerable, be proactive and stay ahead of evolving threats.