Summary On August 31, 2026, Microsoft 365 went down for a large swath of users worldwide. It started with Exchange Online and Outlook, then spread to Teams, SharePoint, OneDrive for Business, Microsoft Purview, Defender XDR, Copilot, and Universal Print. Full recovery took roughly 48 hours, with a handful of services still limping days later. Timeline [...]

Summary: Microsoft patched an Exchange Server privilege-escalation flaw on August Patch Tuesday. On August 27, a public PoC dropped, tied to a Pwn2Own-grade exploit chain capable of full, unauthenticated server takeover. If you run Exchange on-prem, patch now. Timeline August Patch Tuesday — Microsoft ships a fix for CVE-2026-62911 as part of its regular Exchange [...]

Summary: The August 2026 Exchange Server security update removes OWA Light for good. If you can't install the update yet, disable OWA Light manually now, it's tied to a CVE. The Change, in Brief On August 11, 2026, Microsoft released Security Updates (SUs) for: Exchange Server Subscription Edition (SE) — RTM Exchange Server 2019 — [...]

Summary: Microsoft has no release date for Exchange Server SE Cumulative Update 1. The culprit: AI-assisted vulnerability scanning is finding more security issues than the Exchange team can validate and fix without disrupting a CU release. Keep applying monthly security updates. Stop waiting on a CU1 calendar date. On August 13, 2026, the Exchange Server [...]

Microsoft released its August 2026 Exchange Server Security Updates (SUs), addressing vulnerabilities affecting on-premises Exchange Server environments. The updates apply to: Exchange Server Subscription Edition (SE) RTM Exchange Server 2019 CU14 and CU15 Exchange Server 2016 CU23 Exchange Server 2016 and 2019 customers must be enrolled in Microsoft's Period 2 Extended Security Update (ESU) programme [...]

Smart and effective server security that combines real-time threat detection with health monitoring to identify real risks and changes in system reliability. Messageware Incorporated today announced the release of Server Threat Guard (STG) Version 2.9. This release builds on the health monitoring capabilities giving IT and SecOps teams clearer separation between security and health reporting, [...]

The vulnerability: CVE-2026-42897, a cross-site scripting (XSS) flaw in Outlook Web Access (OWA), the browser-based interface for on-premises Microsoft Exchange Server. CVSS score: 8.1 (High). Affected systems: On-premises Exchange Server 2016, 2019, and Subscription Edition (SE). How the attack works: An unauthenticated attacker sends a "half-click" phishing email — no links, no attachments, no action [...]

On July 23, 2026, a bug in Microsoft's automated network maintenance system triggered a nearly five-hour outage across Microsoft 365 and Azure, cutting off a West US datacenter from Microsoft's global network. What happened The outage started at 10:44 AM ET during routine maintenance meant to isolate specific network paths in Microsoft's West US Azure [...]

Microsoft has closed the door on further reprieves for Exchange Server 2016 and 2019. In a July 20, 2026 post, the Exchange Server team confirmed that the Extended Security Update (ESU) program ends when October 2026 ends, with no third coverage period. What Microsoft said "There will be no further extension of Exchange 2016/2019 ESU [...]

Microsoft is officially retiring Outlook on the Web (OWA) Light. First introduced nearly 20 years ago to support legacy browsers and slow network connections, the lightweight email interface has reached the end of its journey. In an upcoming Exchange Server SE update, estimated for August 2026, Microsoft will permanently disable and remove OWA Light. Exchange [...]

Microsoft has released its July 2026 security updates for Exchange Server, addressing four vulnerabilities reported to Microsoft by security partners and found through Microsoft's internal processes. The updates are available for Exchange Server Subscription Edition (SE) as well as legacy versions through the Extended Security Updates (ESU) program. Affected Exchange Server Versions The July 2026 [...]

CVE-2026-45504 is a low-privileged, authenticated Exchange mailbox user can trick on-prem Exchange into reading arbitrary local files (config files, credential material) via a WOPI/WAC URL-parsing flaw. Microsoft patched it June 9, 2026. A public PoC dropped June 24, 2026. If you haven't patched, do it now, exploitability just went from "less likely" to "trivial." Summary [...]

🚨 Actively exploited Exchange Server zero-day is now patched. Refer to the Microsoft June updates section and links below. Messageware June Releases: Messageware AttachView SE/2019, 2016AttachView includes important security updates in our attachment viewing technology. Messageware EPG SE/2019, 2016EPG includes important Spamhaus and Geolocation updates. Get secure with our products:  Server Security and Health monitoring (STG) Exchange [...]

Microsoft has released its June 2026 security updates for Exchange Server, delivering a permanent fix for the actively exploited CVE-2026-42897 Outlook Web Access vulnerability, along with additional vulnerabilities reported by security partners and found through Microsoft's internal processes. The updates are available for Exchange Server Subscription Edition (SE) as well as legacy versions through the [...]

We’re midway through Q2 and there’s lots of interesting news: major updates to Messageware’s Server Threat Guard (STG), the release of Microsoft’s Exchange Server SE HU6, Microsoft extended Exchange support for 2019 & 2016, and a new Exchange Server zero day security threat. Before we dig into those details, I’d like to highlight Messageware Server [...]

Security teams today are buried under an average of 960 alerts a day, and the majority are never investigated by a human at all. The result is missed breaches, mounting burnout, and detection rules that get suppressed just to keep dashboards manageable. This article looks at why the traditional alert-driven model has broken down for [...]

Smart and effective server security that combines real-time threat detection with health monitoring to identify real risks and changes in system reliability. TORONTO - May 26, 2026 - PRLog -- Messageware Incorporated today announced the release of Server Threat Guard (STG) Version 2.8. This latest release marks a significant expansion into proactive server health monitoring, adding intelligent event detection, smart [...]

Microsoft disclosed a critical vulnerability in Exchange Server on May 14, 2026, and it's already being exploited in the wild. Here's a quick breakdown of what it is, who's affected, and what's being done about it. 🚨 The official announcement is subject to ongoing updates — visit the link below to access the latest information: https://techcommunity.microsoft.com/blog/exchange/addressing-exchange-server-may-2026-vulnerability-cve-2026-42897/4518498 [...]

Microsoft has announced that no Exchange Server security updates will be released in May 2026. This covers every currently supported version of Exchange Server, including those participating in the Extended Security Update (ESU) program. Both the ESU program and Exchange security updates more broadly follow an as-needed model — patches are issued only when the [...]

Summary Microsoft released a Hotfix Update (HU6) for Exchange Server Subscription Edition (SE). The release contains no security fixes but delivers a long-awaited functional change that hybrid administrators have been preparing for since 2025: it allows organizations to start switching their Exchange Server hybrid rich coexistence from Exchange Web Services (EWS) to REST-based Microsoft Graph [...]