Microsoft released its August 2026 Exchange Server Security Updates (SUs), addressing vulnerabilities affecting on-premises Exchange Server environments.
The updates apply to:
- Exchange Server Subscription Edition (SE) RTM
- Exchange Server 2019 CU14 and CU15
- Exchange Server 2016 CU23
Exchange Server 2016 and 2019 customers must be enrolled in Microsoft’s Period 2 Extended Security Update (ESU) programme to obtain the August updates. Organizations not enrolled are advised to migrate to Exchange Server Subscription Edition.
Reading our article? Try our product:
Vulnerabilities addressed
This release fixes several vulnerabilities, none currently known to be under active exploitation:
- CVE-2026-62913 — Remote code execution. Microsoft hasn’t published the attack path, affected build range, or CVSS score publicly, but confirms the flaw is real.
- CVE-2026-62914 — Spoofing (CVSS 7.3). Requires user interaction. Also permanently disables the OWA Light client the moment this update is installed (see below).
- CVE-2026-62910 — Elevation of privilege (CVSS 7.2). Requires the attacker to already hold elevated rights, which keeps the score comparatively low.
Full CVE details: check the Security Update Guide, filtering on “Server Software” for Exchange SE and “ESU” for Exchange 2016/2019.
OWA Light is gone
Starting with this update (and every update after it), installing the SU permanently disables the OWA Light client. This is tied to CVE-2026-62914 and was pre-announced weeks ago.
If you can’t install the August 2026 update yet, disable OWA Light manually to mitigate this CVE.
Exchange 2016 and 2019 require Period 2 ESU
Exchange Server 2016 and Exchange Server 2019 are now out of support. Microsoft is only providing security updates for these versions to customers enrolled in the Period 2 ESU programme, which covers updates released between May and October 2026.
Known issue
Wrapper messages appearing in shared mailbox inboxes in hybrid environments, acknowledged, fix coming in a future update.
Patch now
Administrators should use the Exchange Server Health Checker to identify missing CUs, SUs and manual configuration actions, install the August 2026 SU on all applicable Exchange servers and Exchange Management Tools systems, reboot the server after installation, and then run the Health Checker again.
Security Updates are cumulative, so organizations running a supported CU do not need to install every previous SU before deploying the August release.
Fortify Your Server with Messageware Security
Data breaches have increased by 72%, servers are compromised in under 90 minutes. Ensure you have multiple layers of security software protecting your Windows Servers.
Server Threat Guard (STG) for All Windows Servers: Next-gen server protection, providing detection, alerting, and response (MDR) to zero-day and server penetration cyber-attacks. No need to research complicated deployments and no learning curve to install and manage.
EPG Guard for Exchange Servers: Real-time security. Stop AD account lockouts, eliminate password attacks, intelligent GEO blocking, and prevent Exchange Server vulnerability probing.
Don’t leave your critical infrastructure vulnerable, be proactive and stay ahead of evolving threats.