Microsoft has confirmed that the October 2026 Windows Server security updates can cause on-premises Exchange servers to become unstable. Since Patch Tuesday on October 13, admins have reported users unable to sign in to Outlook on the web (OWA), messages stuck in Outlook Outboxes, and mail queues grinding to a halt. The problem affects Exchange [...]
On October 12, Exchange Online administrators found themselves locked out of the Exchange Admin Center (EAC) after a configuration change caused administrators to receive “Internal Server Error” messages when attempting to access the web-based management console. This issue prevented admins from managing Exchange Online resources such as mailboxes and groups, with no workaround available during [...]
Server Threat Guard now analyzes server health events with AI, helping IT teams pinpoint and resolve server issues. Messageware Incorporated today announced the release of Server Threat Guard (STG) version 3, which adds AI-powered analysis. STG turns raw server health data into a prioritized, plain-language briefing with recommended steps to resolve issues. IT and SecOps [...]
⚠️ Known Issue: Windows October 2026 Update After installing the October 2026 Windows security update (KB5126646), some on-premises Exchange servers might experience issues accessing or sending email. Users might be unable to sign in to Outlook on the web (OWA), or email messages sent from Outlook might remain in the Outbox and not be delivered. [...]
Exchange Server Subscription Edition (SE) is now the only supported version of on-premises Exchange, and it’s among the most targeted systems in the enterprise. Exchange Server SE hardening should be the first project after migration, not an afterthought. Microsoft Exchange Server Remains a Prime Target In May 2026, attackers began actively exploiting CVE-2026-42897, a critical [...]
Microsoft re-released its September 2026 Security Updates (SUs) for on-premises Exchange Server. The new "V2" packages add a fix for CVE-2026-96940, an authorization flaw that can let a signed-in user reach mailboxes that are not their own. If you installed the original September update, your servers are not protected against this issue. The V2 package [...]
Microsoft has released its September 2026 security updates for Exchange Server, addressing nine vulnerabilities reported by security partners and found through Microsoft's internal processes. The updates are available for Exchange Server Subscription Edition (SE), and for Exchange Server 2016 and 2019 through the Extended Security Update (ESU) program. Affected Exchange Server Versions The September 2026 [...]
Summary On August 31, 2026, Microsoft 365 went down for a large swath of users worldwide. It started with Exchange Online and Outlook, then spread to Teams, SharePoint, OneDrive for Business, Microsoft Purview, Defender XDR, Copilot, and Universal Print. Full recovery took roughly 48 hours, with a handful of services still limping days later. Timeline [...]
Summary: Microsoft patched an Exchange Server privilege-escalation flaw on August Patch Tuesday. On August 27, a public PoC dropped, tied to a Pwn2Own-grade exploit chain capable of full, unauthenticated server takeover. If you run Exchange on-prem, patch now. Timeline August Patch Tuesday — Microsoft ships a fix for CVE-2026-62911 as part of its regular Exchange [...]
Summary: The August 2026 Exchange Server security update removes OWA Light for good. If you can't install the update yet, disable OWA Light manually now, it's tied to a CVE. The Change, in Brief On August 11, 2026, Microsoft released Security Updates (SUs) for: Exchange Server Subscription Edition (SE) — RTM Exchange Server 2019 — [...]
Summary: Microsoft has no release date for Exchange Server SE Cumulative Update 1. The culprit: AI-assisted vulnerability scanning is finding more security issues than the Exchange team can validate and fix without disrupting a CU release. Keep applying monthly security updates. Stop waiting on a CU1 calendar date. On August 13, 2026, the Exchange Server [...]
Microsoft released its August 2026 Exchange Server Security Updates (SUs), addressing vulnerabilities affecting on-premises Exchange Server environments. The updates apply to: Exchange Server Subscription Edition (SE) RTM Exchange Server 2019 CU14 and CU15 Exchange Server 2016 CU23 Exchange Server 2016 and 2019 customers must be enrolled in Microsoft's Period 2 Extended Security Update (ESU) programme [...]
Smart and effective server security that combines real-time threat detection with health monitoring to identify real risks and changes in system reliability. Messageware Incorporated today announced the release of Server Threat Guard (STG) Version 2.9. This release builds on the health monitoring capabilities giving IT and SecOps teams clearer separation between security and health reporting, [...]
The vulnerability: CVE-2026-42897, a cross-site scripting (XSS) flaw in Outlook Web Access (OWA), the browser-based interface for on-premises Microsoft Exchange Server. CVSS score: 8.1 (High). Affected systems: On-premises Exchange Server 2016, 2019, and Subscription Edition (SE). How the attack works: An unauthenticated attacker sends a "half-click" phishing email — no links, no attachments, no action [...]
On July 23, 2026, a bug in Microsoft's automated network maintenance system triggered a nearly five-hour outage across Microsoft 365 and Azure, cutting off a West US datacenter from Microsoft's global network. What happened The outage started at 10:44 AM ET during routine maintenance meant to isolate specific network paths in Microsoft's West US Azure [...]
Microsoft has closed the door on further reprieves for Exchange Server 2016 and 2019. In a July 20, 2026 post, the Exchange Server team confirmed that the Extended Security Update (ESU) program ends when October 2026 ends, with no third coverage period. What Microsoft said "There will be no further extension of Exchange 2016/2019 ESU [...]
Microsoft is officially retiring Outlook on the Web (OWA) Light. First introduced nearly 20 years ago to support legacy browsers and slow network connections, the lightweight email interface has reached the end of its journey. In an upcoming Exchange Server SE update, estimated for August 2026, Microsoft will permanently disable and remove OWA Light. Exchange [...]
Microsoft has released its July 2026 security updates for Exchange Server, addressing four vulnerabilities reported to Microsoft by security partners and found through Microsoft's internal processes. The updates are available for Exchange Server Subscription Edition (SE) as well as legacy versions through the Extended Security Updates (ESU) program. Affected Exchange Server Versions The July 2026 [...]
CVE-2026-45504 is a low-privileged, authenticated Exchange mailbox user can trick on-prem Exchange into reading arbitrary local files (config files, credential material) via a WOPI/WAC URL-parsing flaw. Microsoft patched it June 9, 2026. A public PoC dropped June 24, 2026. If you haven't patched, do it now, exploitability just went from "less likely" to "trivial." Summary [...]
🚨 Actively exploited Exchange Server zero-day is now patched. Refer to the Microsoft June updates section and links below. Messageware June Releases: Messageware AttachView SE/2019, 2016AttachView includes important security updates in our attachment viewing technology. Messageware EPG SE/2019, 2016EPG includes important Spamhaus and Geolocation updates. Get secure with our products: Server Security and Health monitoring (STG) Exchange [...]
