Messageware

10/14/2026

📢 Microsoft's October 2026 Patch Tuesday for Exchange Server is out, and it's a major one for anyone still on Exchange 2016 or 2019.

• 6 vulnerabilities patched, including a critical remote code ex*****on flaw
• Fixes for Exchange SE, plus 2019 and 2016 via the Period 2 ESU program

🚨 This is the FINAL security update for Exchange 2016 and 2019. From November, Microsoft stops testing them for new vulnerabilities. If you're running Exchange 2016 or 2019 after this month, every newly discovered flaw stays unpatched. Now is the time to plan your move to Exchange SE.

Full details: https://www.messageware.com/patch-tuesday-exchange-server-security-updates-for-october-2026/

Microsoft’s October 2026 Exchange Server security updates fix 6 CVEs, including a Critical RCE, and are the final SUs for Exchange 2016 and 2019.

10/05/2026

🚨 Microsoft has reissued its September 2026 Exchange Server security update.

The re-release fixes CVE-2026-96940, a CVSS 8.8 authorization flaw. An attacker with valid credentials can use it to access other users' mailboxes, including their email and attachments.

What to do:
• If you installed the original September SU, you're not covered. Install the V2 package.
• Exchange SE RTM gets it through public download. Exchange 2019 CU14/CU15 and 2016 CU23 get it only through Period 2 ESU.
• Hybrid organizations must patch every on-prem server, including management-only servers and Exchange Management Tools machines.

Full breakdown: https://www.messageware.com/microsoft-reissues-september-2026-exchange-server-updates/

Microsoft's September 2026 V2 Exchange update fixes CVE-2026-96940, a CVSS 8.8 flaw letting signed-in users access other mailboxes.

09/10/2026

📢Patch Tuesday: Exchange Server, September 2026

Microsoft closed out nine vulnerabilities in this month's Exchange Server updates, including a 9.3-severity spoofing flaw that lets an attacker impersonate a sender.

None are currently known to be under active exploitation.

Exchange 2016 and 2019 admins: these updates are ESU-only. If you're not enrolled in Period 2 ESU, it's time to plan your migration to Exchange SE.

Full breakdown: https://www.messageware.com/patch-tuesday-exchange-server-security-updates-for-september-2026/

Microsoft's September 2026 Exchange Server security updates patch 9 vulnerabilities, including a 9.3-severity spoofing flaw.

09/04/2026

🚨 Exchange admins, patch now:

A working proof-of-concept exploit is now public for CVE-2026-62911, a critical Microsoft Exchange Server vulnerability.

The PoC is tied to a three-vulnerability chain demonstrated at Pwn2Own Berlin, capable of full, unauthenticated server takeover.

If you're running Exchange on-prem, patch now.

Affected versions, the fix, and mitigation steps if you can't patch immediately: https://www.messageware.com/cve-2026-62911-exchange-server-poc-is-public-patch-now/

A working PoC is public for CVE-2026-62911, a critical Exchange Server flaw tied to a Pwn2Own exploit chain. See affected versions and patch.

08/12/2026

📢 Microsoft has released the August 2026 Exchange Server Security Updates.

Key points:
• Security updates are available for Exchange Server SE, 2019 and 2016
• CVE-2026-62914 is addressed
• OWA Light is permanently disabled starting with this update
• Exchange 2016 and 2019 updates require enrolment in the Period 2 ESU programme
• Hybrid environments with on-premises Exchange servers still need to apply the update

Read more: https://www.messageware.com/patch-tuesday-august-2026-exchange-server-security-updates/

Microsoft released August 2026 Exchange Server security updates addressing multiple CVEs including CVE-2026-62913, CVE-2026-62914 and CVE-2026-62910

08/06/2026

Messageware has released Server Threat Guard v2.9

What's new:

· Clearer separation between security and health reporting
· Expanded IIS configuration change detection
· Smarter health alert throttling
· Improved reporting to help IT and SecOps teams focus on what matters most

Free, fully supported production trials: https://www.messageware.com/server-threat-guard/

Secure Microsoft Windows Servers with threat detection & health monitoring to rapidly identify zero-day attacks, exploits, and instability.

06/11/2026

📢 Microsoft released the June 2026 Exchange Server Security Updates on June 8, 2026.

Affected versions:
• Exchange Server SE
• Exchange Server 2019 (ESU Period 2 enrollees only)
• Exchange Server 2016 (ESU Period 2 enrollees only)

CVEs addressed:
• CVE-2026-42897 — cross-site scripting (XSS) vulnerability
• Additional vulnerabilities identified through Microsoft's internal security processes

Critical deadline — July 2026:
Servers not running the June 2026 SU or newer will lose access to Emergency Mitigation (EM) service configurations and Feature Flighting updates starting July 2026.

ESU note:
Exchange 2016 and 2019 SUs are restricted to organisations enrolled in the Period 2 ESU program (May–October 2026). Organisations not enrolled should prioritise migration to Exchange Server SE.

CVE-2026-42897 mitigation:
Existing mitigations are not automatically removed by the SU. Microsoft advises keeping them in place until further notice.

Read more: https://www.messageware.com/patch-tuesday-exchange-server-security-updates-for-june-2026/

Microsoft released June 2026 Exchange Server security updates addressing CVE-2026-42897, a critical Outlook Web Access vulnerability.

05/28/2026

🚀 Server Threat Guard v2.8 is here.

We're excited to announce the latest release of Server Threat Guard (STG). v2.8 expands beyond real-time security threat detection into proactive server health monitoring, helping IT and SecOps teams shift from reacting to outages to preventing them.

What's new in v2.8:

🔍 Real-time health event detection for critical and error-level conditions
📊 A centralized health dashboard for system status at a glance
🔔 Intelligent alerting and daily health summaries, designed to cut alert fatigue
🧠 Context-aware insights that separate routine activity from issues that need attention

Built for Windows Servers, on-premises and in the cloud.

Available now, with free, fully supported production trials. 👇 https://pages.messageware.com/get-protected-with-server-threat-guard

05/15/2026

🚨 Active Exploit Alert: CVE-2026-42897 — Microsoft Exchange Server. A high-severity XSS vulnerability in Exchange Server 2016, 2019, and SE is being actively exploited via crafted emails in Outlook Web Access.

Key facts:
• CVSS score: 8.1 (High)
• No permanent patch yet — mitigation available via EEMS or EOMT
• Exchange Online users are not affected

If your organization runs on-premises Exchange, check your mitigation status now.

Details here: https://www.messageware.com/critical-exchange-server-vulnerability-cve-2026-42897/

CVE-2026-42897 is an actively exploited Exchange Server vulnerability. Learn what's affected, the current risk level, and how Microsoft is mitigating it.

05/14/2026

📢 Heads up to Exchange admins: Microsoft has confirmed there will be no Exchange Server security updates released in May 2026.

This applies to all supported versions, including those in the Extended Security Update (ESU) program.

Full details:

Microsoft announces there are no Exchange Server security updates for May 2026, for customers with Exchange SE, or Exchange 2016, 2019 ESU.