On October 12, Exchange Online administrators found themselves locked out of the Exchange Admin Center (EAC) after a configuration change caused administrators to receive “Internal Server Error” messages when attempting to access the web-based management console. This issue prevented admins from managing Exchange Online resources such as mailboxes and groups, with no workaround available during [...]

Server Threat Guard now analyzes server health events with AI, helping IT teams pinpoint and resolve server issues. Messageware Incorporated today announced the release of Server Threat Guard (STG) version 3, which adds AI-powered analysis. STG turns raw server health data into a prioritized, plain-language briefing with recommended steps to resolve issues. IT and SecOps [...]

Microsoft has released its October 2026 security updates for Exchange Server, addressing six vulnerabilities reported by security partners and found through Microsoft's internal processes. The updates are available for Exchange Server Subscription Edition (SE), and for Exchange Server 2016 and 2019 through the Extended Security Update (ESU) program. This is a milestone release: it is [...]

Microsoft re-released its September 2026 Security Updates (SUs) for on-premises Exchange Server. The new "V2" packages add a fix for CVE-2026-96940, an authorization flaw that can let a signed-in user reach mailboxes that are not their own. If you installed the original September update, your servers are not protected against this issue. The V2 package [...]

Microsoft has released its September 2026 security updates for Exchange Server, addressing nine vulnerabilities reported by security partners and found through Microsoft's internal processes. The updates are available for Exchange Server Subscription Edition (SE), and for Exchange Server 2016 and 2019 through the Extended Security Update (ESU) program. Affected Exchange Server Versions The September 2026 [...]

Summary On August 31, 2026, Microsoft 365 went down for a large swath of users worldwide. It started with Exchange Online and Outlook, then spread to Teams, SharePoint, OneDrive for Business, Microsoft Purview, Defender XDR, Copilot, and Universal Print. Full recovery took roughly 48 hours, with a handful of services still limping days later. Timeline [...]

Summary: Microsoft patched an Exchange Server privilege-escalation flaw on August Patch Tuesday. On August 27, a public PoC dropped, tied to a Pwn2Own-grade exploit chain capable of full, unauthenticated server takeover. If you run Exchange on-prem, patch now. Timeline August Patch Tuesday — Microsoft ships a fix for CVE-2026-62911 as part of its regular Exchange [...]

Summary: The August 2026 Exchange Server security update removes OWA Light for good. If you can't install the update yet, disable OWA Light manually now, it's tied to a CVE. The Change, in Brief On August 11, 2026, Microsoft released Security Updates (SUs) for: Exchange Server Subscription Edition (SE) — RTM Exchange Server 2019 — [...]

Summary: Microsoft has no release date for Exchange Server SE Cumulative Update 1. The culprit: AI-assisted vulnerability scanning is finding more security issues than the Exchange team can validate and fix without disrupting a CU release. Keep applying monthly security updates. Stop waiting on a CU1 calendar date. On August 13, 2026, the Exchange Server [...]

Microsoft released its August 2026 Exchange Server Security Updates (SUs), addressing vulnerabilities affecting on-premises Exchange Server environments. The updates apply to: Exchange Server Subscription Edition (SE) RTM Exchange Server 2019 CU14 and CU15 Exchange Server 2016 CU23 Exchange Server 2016 and 2019 customers must be enrolled in Microsoft's Period 2 Extended Security Update (ESU) programme [...]

Smart and effective server security that combines real-time threat detection with health monitoring to identify real risks and changes in system reliability. Messageware Incorporated today announced the release of Server Threat Guard (STG) Version 2.9. This release builds on the health monitoring capabilities giving IT and SecOps teams clearer separation between security and health reporting, [...]

The vulnerability: CVE-2026-42897, a cross-site scripting (XSS) flaw in Outlook Web Access (OWA), the browser-based interface for on-premises Microsoft Exchange Server. CVSS score: 8.1 (High). Affected systems: On-premises Exchange Server 2016, 2019, and Subscription Edition (SE). How the attack works: An unauthenticated attacker sends a "half-click" phishing email — no links, no attachments, no action [...]

On July 23, 2026, a bug in Microsoft's automated network maintenance system triggered a nearly five-hour outage across Microsoft 365 and Azure, cutting off a West US datacenter from Microsoft's global network. What happened The outage started at 10:44 AM ET during routine maintenance meant to isolate specific network paths in Microsoft's West US Azure [...]

Microsoft has closed the door on further reprieves for Exchange Server 2016 and 2019. In a July 20, 2026 post, the Exchange Server team confirmed that the Extended Security Update (ESU) program ends when October 2026 ends, with no third coverage period. What Microsoft said "There will be no further extension of Exchange 2016/2019 ESU [...]

Microsoft is officially retiring Outlook on the Web (OWA) Light. First introduced nearly 20 years ago to support legacy browsers and slow network connections, the lightweight email interface has reached the end of its journey. In an upcoming Exchange Server SE update, estimated for August 2026, Microsoft will permanently disable and remove OWA Light. Exchange [...]

Microsoft has released its July 2026 security updates for Exchange Server, addressing four vulnerabilities reported to Microsoft by security partners and found through Microsoft's internal processes. The updates are available for Exchange Server Subscription Edition (SE) as well as legacy versions through the Extended Security Updates (ESU) program. Affected Exchange Server Versions The July 2026 [...]

CVE-2026-45504 is a low-privileged, authenticated Exchange mailbox user can trick on-prem Exchange into reading arbitrary local files (config files, credential material) via a WOPI/WAC URL-parsing flaw. Microsoft patched it June 9, 2026. A public PoC dropped June 24, 2026. If you haven't patched, do it now, exploitability just went from "less likely" to "trivial." Summary [...]

🚨 Actively exploited Exchange Server zero-day is now patched. Refer to the Microsoft June updates section and links below. Messageware June Releases: Messageware AttachView SE/2019, 2016AttachView includes important security updates in our attachment viewing technology. Messageware EPG SE/2019, 2016EPG includes important Spamhaus and Geolocation updates. Get secure with our products:  Server Security and Health monitoring (STG) Exchange [...]

Microsoft has released its June 2026 security updates for Exchange Server, delivering a permanent fix for the actively exploited CVE-2026-42897 Outlook Web Access vulnerability, along with additional vulnerabilities reported by security partners and found through Microsoft's internal processes. The updates are available for Exchange Server Subscription Edition (SE) as well as legacy versions through the [...]