# Microsoft Exchange Server security and stability issues

> Live situation record from CLSTR: https://clstr.news/situations/microsoft-exchange-server-security-and-stability-issues
> Updated: 2026-10-19T10:15:34.000Z. Sources: 14. Developments: 3.

In early October 2026, Microsoft released V2 security updates for Exchange Server SE, 2019, and 2016 to address a critical elevation of privilege vulnerability, identified as CVE-2026-96940. This flaw could allow attackers with low-level credentials to gain unauthorized access to mailboxes and attachments within an organization.

By mid-October, technical instability emerged following the October 13 Windows Server cumulative updates. These issues caused failures in Outlook, OWA, and email transport for Exchange Server environments. Microsoft clarified that the instability was caused by the Windows Server updates rather than the Exchange security patches themselves.

On October 17, Microsoft released an official workaround, advising administrators against uninstalling the security updates. The recommended fix involves setting the registry value ‘EpmapSavedContextCap’ to 65536 and restarting the server. By October 19, Microsoft confirmed that the malfunctions stem from a new limitation in the updates that restricts the RPC Endpoint Mapper to a maximum of 512 simultaneous contexts. This causes errors such as ‘MapiExceptionMdbOffline’ (Event ID 1006) and halts mail queues when workloads exceed the limit. Microsoft has not yet provided a timeline for a permanent corrective update.

This period of technical volatility coincides with the conclusion of the Extended Security Update (ESU) program for Exchange 2016 and 2019, meaning these versions will no longer receive official security patches.

## Timeline

### 2026-10-19: Microsoft Exchange Server experiences outages following Windows updates

Microsoft confirmed that October Windows Server updates cause Exchange Server outages by limiting RPC Endpoint Mapper contexts. A registry workaround is required to prevent mail flow disruptions.

4 sources. https://clstr.news/cluster/microsoft-exchange-server-experiences-outages-following-windows-updates

### 2026-10-17: Microsoft releases workaround for Exchange Server update failures

Microsoft issued a registry workaround for Exchange Server stability issues caused by October 2026 Windows Server updates, as support for Exchange 2016 and 2019 officially ends.

7 sources. https://clstr.news/cluster/microsoft-releases-workaround-for-exchange-server-update-failures

### 2026-10-02: Microsoft releases Exchange Server security updates for CVE-2026-96940

Microsoft released V2 security updates for Exchange Server to fix CVE-2026-96940, an elevation of privilege vulnerability that could allow attackers to access other users' mailboxes.

6 sources. https://clstr.news/cluster/microsoft-releases-exchange-server-security-updates-for-cve-2026-96940

---
Cite as: Microsoft Exchange Server security and stability issues. CLSTR, https://clstr.news/situations/microsoft-exchange-server-security-and-stability-issues