Exchange October 2026 Updates: Final ESU Patches for 2016 and 2019, Six CVEs Fixed

Alongside patching six security vulnerabilities—including a remote code execution (RCE) flaw—and fixing two frustrating operational regressions from earlier updates, this release marks the final month that organizations enrolled in the Period 2 ESU program will receive newly issued security patches for Exchange 2016 and 2019. Starting next month, Exchange Server Subscription Edition (SE) will be the sole on-premises Exchange platform receiving ongoing security servicing.

Here is a complete breakdown of the October 2026 security updates, the bugs they squash, and what the post-ESU landscape means for your messaging infrastructure.

The October 2026 Security Update Lineup​

Microsoft’s Exchange Team has released October 2026 Security Updates (SUs) across its current Subscription Edition and, for one last time, the legacy versions covered under the Period 2 ESU program (which ran from May through October 2026).

According to Microsoft Support documentation, the specific update packages and applicability are as follows:

For Exchange Server SE RTM, the standalone installer (ExchangeSubscriptionEdition-KB5128895-x64-en.exe) supersedes the September 8, 2026 security update (KB5121608) and follows the out-of-band September 2026 V2 update (KB5129955) that shipped in early October. Because Exchange SUs are cumulative, administrators running a supported Cumulative Update (CU) do not need to apply missed intermediate SUs or hotfix updates sequentially; you can jump straight to the October 2026 SU.

Six Vulnerabilities Patched​

The Exchange Team notes that the vulnerabilities addressed in this cycle were discovered through Microsoft’s internal security processes and reported responsibly by external security partners. While the announcement does not indicate active exploitation in the wild, the lineup of Common Vulnerabilities and Exposures (CVEs) listed on Microsoft's support documentation for KB5128895 warrants prompt deployment:

• CVE-2026-70571: Microsoft Exchange Server Remote Code Execution Vulnerability
• CVE-2026-77910: Microsoft Exchange Server Elevation of Privilege Vulnerability
• CVE-2026-87692: Microsoft Exchange Server Elevation of Privilege Vulnerability
• CVE-2026-87695: Microsoft Exchange Server Elevation of Privilege Vulnerability
• CVE-2026-87696: Microsoft Exchange Server Elevation of Privilege Vulnerability
• CVE-2026-70279: Microsoft Exchange Server Spoofing Vulnerability

Administrators looking for granular CVE specifics inside the Microsoft Security Update Guide should filter the Product Family column to Server Software for Exchange SE, or filter to ESU for Exchange 2016 and 2019. Exchange Online is already protected against these vulnerabilities in the cloud, meaning cloud-only tenants require no action—though hybrid environments still have homework to do on-premises.

Section Summary: The October 2026 release delivers SU11 for Exchange SE RTM (KB5128895) and final ESU patches for Exchange 2019 CU14/CU15 and Exchange 2016 CU23, resolving one RCE flaw, four elevation-of-privilege bugs, and one spoofing vulnerability.

Non-Security Fixes: Deadlocks and Broken Calendars Resolved​

If you have ever applied a routine monthly security patch only to have your helpdesk light up with bizarre client symptoms, two non-security fixes bundled into the October 2026 updates will look very welcome.

1. ContentEngine Deadlock on Korean Language Content (KB5130098)​

After deploying the September 2026 Security Update on Exchange Server SE, environments processing emails with Korean-language text ran into a severe operational snag. Because required assembly files for an updated Korean WordBreaker were inadvertently omitted from the September update package, servers experienced ContentEngine deadlocks.

In practice, that missing assembly manifested as:

• Missing search results across mailboxes.
• Delayed email delivery.
• MAPI and Outlook clients stalling, disconnecting, or becoming completely unresponsive.

Installing KB5128895 (Exchange SE RTM SU11) permanently resolves this defect. Microsoft Support notes that if your team previously applied the manual file-copy workaround to stop the bleeding in September, no extra cleanup steps are required before or after installing the October update.

2. Published Calendar (.ics) Subscriptions Returning HTTP 500 (KB5126672)​

Starting with the August 2026 security update (identified on Exchange SE as build 15.2.2562.46), subscriptions to anonymously published Exchange calendars (.ics links) stopped refreshing. Subscribing calendar applications threw server errors, and attempts to hit the published calendar URL directly returned an HTTP 500 status code.

This regression affected Exchange Server SE, Exchange Server 2019, and Exchange Server 2016. It is resolved across all four October 2026 packages (KB5128895, KB5128896, KB5128897, and KB5128898).

Section Summary: Beyond CVE mitigations, the October updates repair an August regression that broke anonymous .ics calendar feeds with HTTP 500 errors and a September packaging oversight in Exchange SE that triggered Outlook disconnects and mail delays when indexing Korean text.

The Curtain Falls on Exchange 2016 and 2019 Extended Security Updates​

Exchange Server 2016 and Exchange Server 2019 reached their formal end of support a full year ago, in October 2025. To give stragglers breathing room while migrating to Exchange Online or upgrading to Exchange Server Subscription Edition, Microsoft offered Extended Security Updates through a two-period structure, with Period 2 spanning May 2026 to October 2026.

With the October 2026 patches now out the door, that runway has officially ended. The Exchange Team laid out the stark reality of what happens after October 2026:

1. Exchange SE Only: Future security updates will be released exclusively for Exchange Server Subscription Edition (SE).
2. Silence in MSRC Advisories: Microsoft Security Response Center (MSRC) CVEs and Exchange Team update announcements will no longer list Exchange 2016 or Exchange 2019.
3. No Further Vulnerability Testing: Microsoft is halting internal vulnerability testing against Exchange 2016 and 2019 codebases.

Why does that second point matter so much for enterprise security teams? Because in the world of vulnerability management, silence is not safety. When a new RCE or privilege escalation vulnerability is discovered in Exchange Server SE six months from now, the underlying code is very likely shared with Exchange 2019 and 2016. Attackers routinely reverse-engineer patches released for supported software to weaponize the exact same flaw against unpatched legacy servers. Even though future MSRC bulletins won't list Exchange 2016 or 2019 as "affected," Microsoft explicitly warns that those legacy versions remain vulnerable.

For organizations that still haven't purchased Period 2 ESU but desperately need the May through October 2026 patches to secure their boxes during a late migration, Microsoft states that the ability to purchase Period 2 ESU will remain open for a limited time. However, buying in now only catches your servers up through this October 2026 release—no November patches are coming.

Section Summary: October 2026 is the final month of Period 2 ESU coverage for Exchange 2016 and 2019. Moving forward, only Exchange SE will be tested and patched, and future CVE advisories will omit legacy versions even when shared code leaves them exposed.

Practical Deployment Guidance and Hybrid Gotchas​

Before you fire up an elevated command prompt and start patching production servers, Microsoft’s deployment guidance highlights several operational details that frequently trip up administrators—especially in hybrid and Windows Server 2025 environments.

Don't Forget 'Management Tools Only' Machines and Hybrid Boxes​

A common misconception in Microsoft 365 hybrid deployments is that if all mailboxes live in Exchange Online and the local Exchange box only exists for recipient management, it doesn't need urgent patching. Microsoft makes it clear that all on-premises Exchange servers must be updated, even if they are only used for management purposes.

Furthermore, you should apply the October SU to every workstation or member server running the Exchange Management Tools to maintain version compatibility between client tools and servers.

Check Your Hybrid Auth Certificate​

If your maintenance window involves rotating or replacing the Exchange OAuth/authentication certificate after installing the security update, remember to re-run the Hybrid Configuration Wizard (HCW) afterward so hybrid mail flow and free/busy lookups don't break.

The Windows Server 2025 Uninstall Quirk​

If you are running Exchange on Windows Server 2025, you might notice something peculiar after installing an Exchange Security Update or Hotfix Update: the update does not appear in the classic Control Panel's "Installed Updates" view. While Microsoft strongly advises against uninstalling security updates, administrators who run into an emergency rollback scenario on Windows Server 2025 should consult Microsoft Support’s dedicated documentation ("Can't view or uninstall Exchange security or hotfix updates in Control Panel on Windows Server 2025") rather than assuming the update failed to register.

Recommended Update Checklist​

To ensure a smooth rollout, follow standard Exchange servicing best practices:

1. Inventory First: Run the Exchange Server Health Checker PowerShell script across your fleet to identify any servers lagging on Cumulative Updates, Security Updates, or required manual configuration steps.
2. Apply the Update: Download the appropriate .exe package (such as KB5128895 for Exchange SE RTM) and run it from an elevated command prompt (Run as administrator).
3. Reboot and Verify Services: Restart the server once setup completes. Immediately check that all Microsoft Exchange services have started properly. If services remain in a Disabled state after rebooting, that is a telltale sign that the update installation was interrupted or failed mid-flight.
4. Re-run Health Checker: Execute the Exchange Server Health Checker script again post-reboot to verify the build number and confirm whether any additional post-installation steps are required.

For organizations still clinging to Exchange 2016 or 2019, this October 2026 patch cycle is your final safety net. Apply your final ESU updates, audit your migration blockers, and prioritize moving those remaining workloads to Exchange Server SE or Exchange Online before the November Patch Tuesday cycle arrives.