Microsoft has released its October 2026 security updates for Exchange Server, addressing six vulnerabilities reported by security partners and found through Microsoft’s internal processes. The updates are available for Exchange Server Subscription Edition (SE), and for Exchange Server 2016 and 2019 through the Extended Security Update (ESU) program.

This is a milestone release: it is the last security update Exchange Server 2016 and 2019 will ever receive, even for organizations enrolled in Period 2 ESU.

Reading our article? Try our product:

Full Protection for Windows Servers - Zero-Risk Trial

Affected Exchange Server Versions

The October 2026 security updates are available for the following Exchange Server versions.

Exchange Server Subscription Edition (SE) RTM — KB5128895 (SU11)

Exchange Server 2019 CU15 — KB5128896 (ESU enrollment required)

Exchange Server 2019 CU14 — KB5128897 (ESU enrollment required)

Exchange Server 2016 CU23 — KB5128898 (ESU enrollment required)

Six Vulnerabilities Patched

This month’s release closes six CVEs across Exchange Server. Unlike September, one vulnerability is rated “Critical”: a remote code execution flaw. The remaining five are rated “Important,” and the highest-scoring issue overall is a spoofing vulnerability:

  • CVE-2026-70279 — Spoofing (CVSS 9.3): allows an attacker to impersonate a trusted sender or resource.
  • CVE-2026-77910 — Elevation of Privilege (CVSS 8.8): lets an attacker gain elevated privileges within Exchange.
  • CVE-2026-70571 — Remote Code Execution (CVSS 8.1, Critical): allows an attacker to execute code on the server.
  • CVE-2026-87692 — Elevation of Privilege (CVSS 7.8): a separate privilege escalation issue.
  • CVE-2026-87695 — Elevation of Privilege (CVSS 7.8): a separate privilege escalation issue.
  • CVE-2026-87696 — Elevation of Privilege (CVSS 7.5): a separate privilege escalation issue.

Full details on each CVE are available in the Security Update Guide — filter on Server Software under Product Family for Exchange SE, and ESU under Product Family for Exchange 2016 and 2019.

Exchange Online Customers: No Action Needed

These vulnerabilities affect on-premises Exchange Server. Exchange Online customers are already protected and don’t need to do anything beyond updating any on-premises Exchange servers or workstations running the Exchange Management Tools in a hybrid environment. If you change the auth certificate after installing the SU, re-run the Hybrid Configuration Wizard.

Resolved Issues

Issues resolved in this release:

  • Published calendars (.ics) returning an HTTP 500 error for calendar applications — the known issue flagged in last month’s release is now fixed.
  • A ContentEngine deadlock caused by missing Korean WordBreaker rule files.

Final Security Updates for Exchange Server 2016 and 2019

Exchange Server 2016 and 2019 have now been out of support for a full year, and October 2026 is the last month that organizations enrolled in the Period 2 Extended Security Update (ESU) program will receive new security updates for them. From November 2026:

  • Only Exchange SE will receive security updates.
  • Microsoft will stop testing Exchange 2016 and 2019 for vulnerabilities. Future update announcements and MSRC CVEs will no longer mention these versions, which does not mean they aren’t affected by newly discovered flaws.
  • Period 2 ESU can still be purchased for a limited time, but it will only bring you up to date through this October 2026 release.

Any Exchange 2016 or 2019 server still running after this month will be exposed to every new vulnerability discovered from here on, with no patch coming. Organizations should prioritize migrating to Exchange Server SE. For servers that can’t be migrated immediately, additional layers of protection become essential.

How to Install the October 2026 Updates

  1. Inventory your servers. Run the Exchange Server Health Checker script to see which of your servers are behind on CUs, SUs, or other manual actions.
  2. Get to a supported CU. If you’re not already on SE RTM, Exchange 2019 CU14/CU15, or Exchange 2016 CU23, use the Exchange Update Wizard to plan your path from your current CU to your target CU.
  3. Install the October 2026 SU appropriate to your version. SUs are cumulative, so if you’ve missed previous months you only need to install the latest SU for your CU. Install it on all Exchange servers and on any machines running the Exchange Management Tools.
  4. Reboot and verify. After setup finishes, reboot the server and confirm all Exchange services started correctly. Services stuck in a disabled state usually mean installation was interrupted.
  5. Troubleshoot if needed. If setup errors out, run the SetupAssist script, or consult Microsoft’s guidance for repairing failed Exchange CU/SU installations and resolving file-version errors during setup.

Sources: Microsoft — Released: October 2026 Exchange Server Security Updates; Microsoft Support KB articles 5128895, 5128896, 5128897, 5128898; MSRC Security Update Guide.

Fortify Your Server with Messageware Security

Data breaches have increased by 72%, servers are compromised in under 90 minutes. Ensure you have multiple layers of security software protecting your Windows Servers.

Server Threat Guard (STG) for All Windows Servers: Next-gen server protection, providing detection, alerting, and response (MDR) to zero-day and server penetration cyber-attacks. No need to research complicated deployments and no learning curve to install and manage.

EPG Guard for Exchange Servers: Real-time security. Stop AD account lockouts, eliminate password attacks, intelligent GEO blocking, and prevent Exchange Server vulnerability probing.

Don’t leave your critical infrastructure vulnerable, be proactive and stay ahead of evolving threats.