Messageware

06/11/2026

📢 Microsoft released the June 2026 Exchange Server Security Updates on June 8, 2026.

Affected versions:
• Exchange Server SE
• Exchange Server 2019 (ESU Period 2 enrollees only)
• Exchange Server 2016 (ESU Period 2 enrollees only)

CVEs addressed:
• CVE-2026-42897 — cross-site scripting (XSS) vulnerability
• Additional vulnerabilities identified through Microsoft's internal security processes

Critical deadline — July 2026:
Servers not running the June 2026 SU or newer will lose access to Emergency Mitigation (EM) service configurations and Feature Flighting updates starting July 2026.

ESU note:
Exchange 2016 and 2019 SUs are restricted to organisations enrolled in the Period 2 ESU program (May–October 2026). Organisations not enrolled should prioritise migration to Exchange Server SE.

CVE-2026-42897 mitigation:
Existing mitigations are not automatically removed by the SU. Microsoft advises keeping them in place until further notice.

Read more: https://www.messageware.com/patch-tuesday-exchange-server-security-updates-for-june-2026/

Microsoft released June 2026 Exchange Server security updates addressing CVE-2026-42897, a critical Outlook Web Access vulnerability.

05/28/2026

🚀 Server Threat Guard v2.8 is here.

We're excited to announce the latest release of Server Threat Guard (STG). v2.8 expands beyond real-time security threat detection into proactive server health monitoring, helping IT and SecOps teams shift from reacting to outages to preventing them.

What's new in v2.8:

🔍 Real-time health event detection for critical and error-level conditions
📊 A centralized health dashboard for system status at a glance
🔔 Intelligent alerting and daily health summaries, designed to cut alert fatigue
🧠 Context-aware insights that separate routine activity from issues that need attention

Built for Windows Servers, on-premises and in the cloud.

Available now, with free, fully supported production trials. 👇 https://pages.messageware.com/get-protected-with-server-threat-guard

05/15/2026

🚨 Active Exploit Alert: CVE-2026-42897 — Microsoft Exchange Server. A high-severity XSS vulnerability in Exchange Server 2016, 2019, and SE is being actively exploited via crafted emails in Outlook Web Access.

Key facts:
• CVSS score: 8.1 (High)
• No permanent patch yet — mitigation available via EEMS or EOMT
• Exchange Online users are not affected

If your organization runs on-premises Exchange, check your mitigation status now.

Details here: https://www.messageware.com/critical-exchange-server-vulnerability-cve-2026-42897/

CVE-2026-42897 is an actively exploited Exchange Server vulnerability. Learn what's affected, the current risk level, and how Microsoft is mitigating it.

05/14/2026

📢 Heads up to Exchange admins: Microsoft has confirmed there will be no Exchange Server security updates released in May 2026.

This applies to all supported versions, including those in the Extended Security Update (ESU) program.

Full details:

Microsoft announces there are no Exchange Server security updates for May 2026, for customers with Exchange SE, or Exchange 2016, 2019 ESU.

05/08/2026

📢 Microsoft released Exchange Server SE Hotfix Update 6 (HU6) on May 7, 2026.

The key addition: Microsoft Graph support for hybrid features, a meaningful step away from the legacy EWS protocol toward a more modern hybrid integration architecture.

More details here:

Microsoft released Exchange Server SE HU6 (KB5081755) on May 7, 2026, introducing Microsoft Graph support for hybrid features.

04/21/2026

📢 Microsoft Announces Period 2 Exchange 2016/2019 Extended Security Update (ESU) Program.

If your organisation is still running Exchange Server 2016 or 2019, Microsoft has announced one final extension of security coverage.

Period 2 of the ESU program runs from May 1 to October 31, 2026. This is a paid, optional program designed exclusively for organisations actively mid-migration to Exchange Server Subscription Edition (SE) who need a little more time to cross the finish line.

Important to note:

🔹 Period 1 enrolment does not automatically carry over — re-purchase is required
🔹 Any ESU purchase from April 15, 2026 onwards is treated as Period 2
🔹 Covered versions: Exchange 2016 CU23 and Exchange 2019 CU14/CU15
🔹 Updates are privately delivered — not via Windows Update or the Download Center
🔹 Patches are released only when a qualifying security event occurs — no fixed monthly schedule
🔹 There will be no further extensions after October 2026

Speaking of patch cadence, Microsoft has confirmed no Exchange Server security updates for April 2026.

For more details visit our blog here: https://www.messageware.com/microsoft-extends-exchange-server-2016-2019-esu/

Updates on the Exchange Server 2016/2019 ESU program and how it extends security coverage through October 2026.

03/12/2026

🚀 Messageware Launches Server Threat Guard v2.7

While the prior release focused on expanding vulnerability detection, v2.7 is centered on making that intelligence easier to see and act on through significant UI improvements.

What's new in v2.7:
• At-a-glance dashboards — see the security and health status of every server in your environment from a single view
• One-click server access — review and manage security rules generated by STG's AutoLearn processes directly from the dashboard
• Upgraded reporting — improved filtering and search so you can quickly locate and drill down into threats and incidents

STG continues to deliver real-time threat detection and server health monitoring with a lightweight install and zero data leaving your environment.

Ready to see it in action? 👇
https://pages.messageware.com/get-protected-with-server-threat-guard

02/11/2026

🚨 Microsoft just released critical Exchange Server security updates for February 2026

CVE-2025-64666 is a high-severity elevation of privilege vulnerability (CVSS 7.5) that could allow authenticated attackers to gain administrative control of your Exchange infrastructure.

Important Details:

• Affects Exchange SE, 2019 CU14/CU15, and 2016 CU23
• Patch: KB5074992 now available
• No user interaction required for exploitation
• Network-based attack vector

Exchange Server 2016/2019 customers need ESU enrollment to access these patches.

Read more: https://www.messageware.com/patch-tuesday-exchange-server-security-updates-for-febuary-2026/

Microsoft released February 2026 Exchange Server security updates addressing CVE-2025-64666, a critical elevation of privilege vulnerability.

02/05/2026

Server Threat Guard (STG) v2.6 is now available 🚀

We're excited to announce the latest release of Server Threat Guard, expanding our unified security and health monitoring solution for Windows Servers across on-premises, Azure, AWS, and hybrid environments.

What's new in v2.6:

✅ WSUS Daily Summary Reporting: Receive dedicated Windows Server Update Services (WSUS) daily summary reports alongside your standard system reports to track patch updates.

✅ Silent Install & Automated Deployment: Deploy STG at scale using silent installation and deployment scripts designed for automated rollouts across multiple servers.

STG continues to deliver what IT and SecOps teams need most: intelligent threat detection and comprehensive server health monitoring.

Free, fully supported production trials available now: https://pages.messageware.com/get-protected-with-server-threat-guard

01/15/2026

No Exchange Server Security Updates for January 2026

Microsoft has confirmed no security patches will be released for any Exchange Server version this month, including Exchange SE and ESU-covered Exchange 2016/2019 installations.​

Organizations still running legacy Exchange versions have less than 90 days to complete migration planning before ESU coverage expires.

Read more: https://www.messageware.com/patch-tuesday-no-exchange-updates-for-january-2026/

Microsoft announces there are no Exchange Server security updates for January 2026, for customers with Exchange SE, or Exchange 2016 or 2019 ESU.