[REVISION HISTORY]

Microsoft Exchange Server security and stability issues

Updated 1 time since CLSTR started tracking revisions of this situation.

What changed

2026-10-17 09:17 UTC → 2026-10-19 12:04 UTC · added ~~removed~~

In early October 2026, Microsoft released V2 security updates for Exchange Server SE, 2019, and 2016 to address a critical elevation of privilege vulnerability, identified as CVE-2026-96940. This flaw could allow attackers with low-level credentials to gain unauthorized access to mailboxes and attachments within an organization. By mid-October, technical instability emerged following the October 13 Windows Server cumulative updates. These issues caused failures in Outlook, OWA, and email transport for Exchange Server environments. Microsoft clarified that the instability was caused by the Windows Server updates rather than the Exchange security patches ~~themselves, recommending a specific~~ themselves. On October 17, Microsoft released an official workaround, advising administrators against uninstalling the security updates. The recommended fix involves setting the registry ~~workaround~~ value ‘EpmapSavedContextCap’ to ~~resolve~~ 65536 and restarting the ~~issue.~~ server. By October 19, Microsoft confirmed that the malfunctions stem from a new limitation in the updates that restricts the RPC Endpoint Mapper to a maximum of 512 simultaneous contexts. This causes errors such as ‘MapiExceptionMdbOffline’ (Event ID 1006) and halts mail queues when workloads exceed the limit. Microsoft has not yet provided a timeline for a permanent corrective update. This period of technical volatility coincides with the conclusion of the Extended Security Update (ESU) program for Exchange 2016 and 2019, meaning these versions will no longer receive official security patches.

Versions

Only revisions since CLSTR began indexing content versions appear here. Select a version to see what changed compared to the one before it.