On 13 October 2026 Microsoft shipped what it calls the last security update that Exchange Server 2016 and 2019 will ever get. Three days later the Exchange team published a second post: some Exchange servers were becoming unstable, and the cause was not the Exchange update at all but that month's Windows Server patches. If you run Exchange on your own hardware, both posts land on your desk in the same week.
We wrote about the end-of-support dates and the three ways out in our Exchange 2016/2019 exit plan. This is the shorter, more urgent follow-up: what the October release fixes, how to handle the Windows problem, and what changes from November.
What the October 2026 release covers
According to the Exchange team's release post, the updates are available for Exchange Server Subscription Edition (SE) RTM, Exchange 2019 CU14 and CU15, and Exchange 2016 CU23. The 2016 and 2019 builds are only available to organisations enrolled in the Period 2 Extended Security Update (ESU) program. Exchange Online customers are already protected, but the post is clear that hybrid setups still need the update on every on-premises Exchange server and on any workstation running the Exchange Management Tools.
Microsoft's October security release lists seven Exchange Server CVEs. The one to read first is CVE-2026-70571, a stack-based buffer overflow that Microsoft rates Critical, with a CVSS score of 8.1, allowing an unauthorised attacker to run code over the network. Next is CVE-2026-70279, a cross-site scripting flaw scored 9.3 that an unauthenticated attacker can use for spoofing. Microsoft marked both, along with the elevation-of-privilege bug CVE-2026-96940, as "Exploitation More Likely". None of the seven was listed as publicly disclosed or exploited at release. That is the good news, and it usually does not last long for Exchange.
SUs are cumulative. If your server is on a supported CU, you install only the latest SU, not every one you missed.
The Windows update that is taking Exchange down
The 16 October post describes servers that run fine for a while after patching and then degrade. Reported symptoms include OWA failing with MapiExceptionMdbOffline and event ID 1006 in the Application log, mail queues growing through the day until delivery almost stops, and DAG members failing to reach quorum. A reboot helps, then the problem comes back.
Microsoft names four Windows Server updates as the trigger:
- KB5126646 on Windows Server 2025
- KB5126655 on Windows Server 2022
- KB5126651 on Windows Server 2019
- KB5126868 on Windows Server 2016
Any Exchange version on those Windows builds can be affected, SE included. Busy servers show it sooner. Some may never show it.
Microsoft's advice is not to uninstall the Windows updates. Instead, from an elevated command prompt on the Exchange server, run:
reg add "HKLM\SOFTWARE\Microsoft\Rpc" /v EpmapSavedContextCap /t REG_DWORD /d 65536 /f
Then reboot and watch. If the problem returns, Microsoft says to raise the limit. In practice that means you should schedule the registry change in the same maintenance window as the October patches, rather than waiting for the help desk to report that Outlook cannot connect.
Checking and undoing the registry change
To confirm the value is in place after the reboot, run this from the same elevated prompt:
reg query "HKLM\SOFTWARE\Microsoft\Rpc" /v EpmapSavedContextCap
It should return REG_DWORD 0x10000, which is 65536 in hex. If you manage servers with PowerShell instead, the same check is:
Get-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Rpc" -Name EpmapSavedContextCap
Write down which servers got the value. Once Microsoft ships a fixed Windows update and you have installed it, you can remove the override with reg delete "HKLM\SOFTWARE\Microsoft\Rpc" /v EpmapSavedContextCap /f and reboot. Check the Exchange Team post for its current guidance before you do.
A patch-week checklist
- Run Microsoft's Exchange Server Health Checker on every server, as the release post recommends, to see which CU and SU each one is on.
- Bring each server to a CU the October SU supports before installing it.
- Install the October Windows update and the October Exchange SU in the same window, then apply the RPC registry value.
- After the reboot, confirm every Exchange service has started. Disabled services usually mean an interrupted setup.
- For the next few days, watch queue length and OWA errors closely, not just "server up".
- Patch the management-tools workstations too. They are easy to forget.
From November, 2016 and 2019 go quiet
The release post spells out what happens next. After October 2026, updates will be released for Exchange SE only, and Microsoft's announcements and CVE entries will stop mentioning 2016 and 2019. The team adds that this does not mean those versions are safe from future bugs. Microsoft will simply stop testing them. Buying Period 2 ESU late only brings you up to this October release.
So from the November Patch Tuesday onward, an Exchange 2019 server will be exposed to every new Exchange flaw with no fix and no CVE that even names your version. For organisations in the UAE and Saudi Arabia that kept mail on their own servers for data-residency reasons, the cloud route may not be acceptable either. We looked at those rules in our data-residency guide. That leaves two real paths: an in-place upgrade to Exchange SE, or a move to another mail server you host yourself.
If you are weighing the self-hosted route
Open-source mail servers have matured a lot. We compared the main candidates under real load in Mailcow vs Stalwart vs Mailu. Our own product, FanMail, is built on Stalwart Mail Server and runs fully on your own infrastructure, with a JMAP webmail, calendar, contacts and a built-in admin panel. It has replaced a commercial suite at 10,000-mailbox scale. It is not a drop-in Exchange clone: Outlook users who depend on every Exchange-specific feature should test with real mailboxes before committing.
Whichever way you go, this month's job is the same. Patch, add the registry fix, and put a date on the decision before November's patches arrive without you.
If this is the update that makes you plan the move off Exchange, two things help with the budget: our self-hosted email cost calculator, and the Stalwart sizing notes for 200 to 10,000 mailboxes.
Frequently asked questions
Is October 2026 really the last update for Exchange 2016 and 2019?
Yes. Microsoft's release post says October 2026 is the last month Period 2 ESU customers receive new Exchange 2016 and 2019 security updates, and that later updates will be for Exchange SE only.
Should we uninstall the October Windows update if Exchange becomes unstable?
No. Microsoft recommends keeping the Windows update and setting the EpmapSavedContextCap registry value under HKLM\SOFTWARE\Microsoft\Rpc, then rebooting.
Are any of the October Exchange vulnerabilities being exploited?
Not at release. Microsoft listed none of the seven Exchange CVEs as exploited or publicly disclosed, but rated three as Exploitation More Likely, including the Critical remote code execution bug CVE-2026-70571.
We use Exchange Online with a hybrid server. Do we need to act?
Yes. Exchange Online is protected, but Microsoft says the SU must still be installed on on-premises Exchange servers, even ones used only for management.
Sources: Released: October 2026 Exchange Server Security Updates (Exchange Team, 13 October 2026) and Exchange servers may become unstable after installation of October 2026 Windows updates (Exchange Team, 16 October 2026).
