Microsoft’s November 2026 Exchange Server Security Update (SU12, KB5133453) fixes nine vulnerabilities in Exchange Server Subscription Edition, including CVE-2026-118207, a critical remote code execution flaw that any authenticated user can trigger. This is also the first Patch Tuesday since the Exchange 2016/2019 Extended Security Update programme ended: those versions received nothing this month and never will again.
What’s in the November 2026 SU
Microsoft released the November 2026 SU on 10 November for one version only: Exchange Server SE RTM. The update is published as KB5133453 (Exchange SE RTM SU12, build 15.02.2562.057) and replaces the October 2026 SU (KB5128895).
The vulnerabilities were reported by Microsoft’s security partners or found internally. Exchange Online customers are already protected, but any on-premises Exchange servers and Exchange Management Tools workstations still need the update.
Reading our article? Try our product:
Vulnerabilities fixed
The SU addresses nine CVEs across four categories:
| CVE | Type | CVSS |
|---|---|---|
| CVE-2026-118207 | Remote Code Execution | 8.8 (Critical) |
| CVE-2026-118149 | Remote Code Execution | 8.8 |
| CVE-2026-118150 | Elevation of Privilege | 8.8 |
| CVE-2026-118154 | Elevation of Privilege | 8.8 |
| CVE-2026-118151 | Elevation of Privilege | 7.2 |
| CVE-2026-118157 | Elevation of Privilege | 7.2 |
| CVE-2026-118153 | Denial of Service | 7.5 |
| CVE-2026-118152 | Spoofing | See MSRC |
| CVE-2026-118208 | Spoofing | See MSRC |
None of the nine were publicly disclosed or known to be exploited when the update shipped.
CVE-2026-118207
The headline fix is CVE-2026-118207, the only Exchange vulnerability Microsoft rates Critical this month. An attacker who has any valid account, even a low-privilege one, can send a crafted request to the server and run code on it over the network.
| Attribute | Detail |
|---|---|
| Type | Remote Code Execution |
| CVSS score | 8.8 (temporal 7.7) |
| Attack vector | Network |
| Privileges required | Low |
| User interaction | None |
| Weakness | CWE-706: Use of Incorrectly-Resolved Name or Reference |
| Exploitability | Exploitation More Likely |
| Exploited in the wild | No (at release) |
Microsoft’s “Exploitation More Likely” rating means it expects attackers to build working exploits. Exchange RCE flaws have a long history of being weaponised soon after Patch Tuesday, so don’t wait for a proof of concept to appear.
Don’t forget Windows Search (CVE-2026-116928)
One of this month’s most serious risks to Exchange isn’t in the Exchange SU at all. CVE-2026-116928 is a Windows Search remote code execution vulnerability with a CVSS score of 9.8. Exchange uses Windows Search to index mail, so an unauthenticated attacker can send an email with a malicious attachment, and the server processes it automatically. Nobody has to open the message.
The fix comes in the November 2026 Windows Server cumulative updates, not KB5133453. Install both.
Affected versions
November 2026 is the first month with no updates for Exchange 2016 or 2019. The Period 2 ESU programme only covered updates released between May and October 2026, and Microsoft no longer tests these versions for vulnerabilities. Microsoft’s guidance is to treat them as “permanently vulnerable” and upgrade immediately.
| Version | November 2026 update | How to get it |
|---|---|---|
| Exchange Server SE RTM | KB5133453 (SU12) | Microsoft Download Center |
| Exchange Server 2019 (CU14, CU15) | None: out of support | Upgrade to Exchange SE |
| Exchange Server 2016 (CU23) | None: out of support | Upgrade to Exchange SE |
If you still run Exchange 2016 or 2019, the critical flaws fixed in SE this month are probably present in your servers too, with no patch coming.
Fixed in this release
October 2026 Windows update instability. Some Exchange servers became unstable after the October 2026 Windows Server updates, with reports of Outlook on the web and mail sending failures. The November 2026 Windows Server updates fix this, not the Exchange SU. If you added the registry key workaround in October, you can leave it in place, but it’s no longer needed once the November Windows updates are installed. The order in which you install the Exchange and Windows updates doesn’t matter.
Free/busy in hybrid. Microsoft Graph could show incorrect free/busy availability in Exchange SE hybrid deployments. KB5133453 fixes this.
Exchange Online and hybrid environments
Exchange Online is already protected. Hybrid organisations still need to install the SU on every on-premises Exchange server, including servers kept only for management.
If you change the Auth certificate after installing the SU, re-run the Hybrid Configuration Wizard.
Next steps
- Inventory your servers. Run the Exchange Server Health Checker script to see which servers are missing CUs, SUs or manual configuration steps.
- Install the latest SU only. SUs are cumulative, so servers on Exchange SE RTM can go straight to KB5133453 without installing earlier SUs first.
- Patch everything that runs Exchange. That means every Exchange server, plus every server and workstation with the Exchange Management Tools installed.
- Install the November Windows Server updates. They fix CVE-2026-116928 and the October instability issue.
- Reboot and check services. Confirm all Exchange services have started. Disabled services mean the installation was interrupted. Follow Workaround 1 in Microsoft’s troubleshooting article.
- Troubleshoot if needed. If setup fails, run the SetupAssist script and see Microsoft’s guidance on repairing failed CU and SU installations. Microsoft doesn’t recommend uninstalling SUs. On Windows Server 2025, installed Exchange SUs don’t appear in Control Panel.
- Verify. Run the Health Checker again to confirm the update installed and no further action is required.
Why credentials are the real front line
Look at what this month’s fixes have in common. Both Exchange RCEs and the two highest-scoring privilege escalations need an attacker to sign in first, and a low-privilege account is enough. In other words, one phished or password-sprayed mailbox could be the first step to full control of your Exchange server.
Patching closes these particular holes, but new Exchange flaws arrive every month. Stopping attackers from getting a valid login in the first place protects you against the next one too.
Fortify Your Server with Messageware Security
Data breaches have increased by 72%, servers are compromised in under 90 minutes. Ensure you have multiple layers of security software protecting your Windows Servers.
Server Threat Guard (STG) for All Windows Servers: Next-gen server protection, providing detection, alerting, and response (MDR) to zero-day and server penetration cyber-attacks. No need to research complicated deployments and no learning curve to install and manage.
EPG Guard for Exchange Servers: Real-time security. Stop AD account lockouts, eliminate password attacks, intelligent GEO blocking, and prevent Exchange Server vulnerability probing.
Don’t leave your critical infrastructure vulnerable, be proactive and stay ahead of evolving threats.