Released: September 2026 V2 Exchange Server Security Updates
Microsoft has released new Security Updates (SUs) for Exchange Server Subscription Edition, Exchange Server 2019, and Exchange Server 2016. These updates address vulnerabilities responsibly reported by security partners and discovered internally. The V2 release specifically adds CVE-2026-96940 to the previously released September 2026 SUs. Exchange Online customers are already protected and do not need to take action. However, on-premises Exchange Server customers must install these updates. Exchange Server 2016 and 2019, now out of support, are only receiving updates for organizations enrolled in the Period 2 Extended Security Update (ESU) program through October 2026. Organizations not in the ESU program for these versions should migrate to Exchange Server Subscription Edition for continued security updates. The new SUs are cumulative, meaning only the latest one is needed if a supported Cumulative Update (CU) is installed. It is recommended to install SUs on all Exchange Servers and machines running Exchange Management Tools for compatibility. The release includes fixes for wrapper messages and free/busy availability issues in hybrid environments. Known issues involve calendar applications returning HTTP 500 errors and problems with Korean language emails. Detailed guidance for installation, including script recommendations and troubleshooting, is provided.