Blog Post

Exchange Team Blog
4 MIN READ

Released: August 2026 Exchange Server Security Updates

The_Exchange_Team's avatar
The_Exchange_Team
Platinum Contributor
Aug 11, 2026

Microsoft has released Security Updates (SUs) for vulnerabilities found in:

  • Exchange Server Subscription Edition (SE)
  • Exchange Server 2019
  • Exchange Server 2016

SUs are available for the following specific versions of Exchange Server:

The August 2026 SUs address vulnerabilities responsibly reported to Microsoft by security partners and found through Microsoft’s internal processes.

These vulnerabilities affect Exchange Server. Exchange Online customers are already protected from the vulnerabilities addressed by these SUs and do not need to take any action other than updating any Exchange servers or Exchange Management tools workstations in their environment.

More details about specific CVEs can be found in the Security Update Guide (filter on ‘Server Software’ under Product Family for Exchange SE and ‘ESU’ under Product Family for Exchange 2016 and 2019).

OWA Light is disabled starting with this update

As we announced several weeks ago, this update (and any subsequent updates) permanently disables the OWA Light client when update is installed on an Exchange server. See related CVE-2026-62914 for more information.

Customers who are not able to install August 2026 (or later) update should disable OWA Light on their servers to address this particular CVE.

Exchange 2016 and 2019 updates are available only under the Period 2 ESU program

Exchange Server 2016 and 2019 are out of support. Only customers who enrolled in the Period 2 Extended Security Update (ESU) program are eligible to receive Exchange Server 2016 and 2019 security updates released between May and October 2026.

If you are not part of the Period 2 ESU program, migrate to Exchange Server Subscription Edition (SE) to keep receiving the latest security updates.

If you have already purchased the Period 2 ESU and need information on accessing the latest Security Updates, please contact us by sending an email to ExchangeandSfBServerESUInquiry@service.microsoft.com.

Known issues with this release

Update installation

The following update paths are available:

FAQs

Our organization is in Hybrid mode with Exchange Online. Do we need to do anything?
Exchange Online is already protected, but this SU needs to be installed on your Exchange servers, even if they are used only for management purposes. If you change the auth certificate after installing an SU, you should re-run the Hybrid Configuration Wizard.

The last SU/HU we installed is a few months old. Do we need to install all SUs in order to install the latest one?
SUs are cumulative. If you are running a CU supported by the SU, you do not need to install all SUs or HUs in sequential order; simply install the latest SU. Please see this blog post for more information.

Do we need to install SUs on all Exchange Servers within our organization? What about ‘Management Tools only’ machines?
Our recommendation is to install SUs on all Exchange Servers and all servers and workstations running the Exchange Management Tools to ensure compatibility between management tools clients and servers. If you are trying to update the Exchange Management Tools in the environment with no running Exchange servers, please see this.

Our organization does not have the Exchange 2016 and 2019 Period 2 ESU. How can we get current Exchange 2016 or 2019 updates?
Since Exchange 2016 and 2019 are now out of support, only customers who have enrolled into the Period 2 ESU program (which is valid between May and October 2026) can obtain Exchange 2016 or 2019 updates released after May 2026. For all other customers still running Exchange 2016 or 2019, we recommend that you upgrade your organization to Exchange SE as soon as possible.

Documentation may not be fully available at the time this post is published.

Major updates to this post:

  • Sep 8, 2026: mentioned the correct known issue for August (Graph time zone issue)
  • Aug 28, 2026: Linked to the KB article talking about the anonymous calendar publishing known issue.
  • Aug 25, 2026: Added a known issue with anonymous calendar publishing failing to update after SU is installed, with a workaround.
  • Aug 24, 2026: Added a known issue that can happen with MRS migrations if not all servers are updated to August 2026 updat yet.

The Exchange Server Team

Updated Sep 08, 2026
Version 7.0
administration
announcements
exchange 2016
exchange 2019
exchange se
on premises
security
setup

65 Comments

Show More
  • tylerdami's avatar
    tylerdami
    Copper Contributor
    Aug 13, 2026

    We found that after the July updates, our Exchange management accounts needed mailboxes associated or EPC threw a continuous error that prevented us from using the console. Is that a new known dependency? Thanks! 

    • ChristianKalz's avatar
      ChristianKalz
      Tin Contributor
      Aug 14, 2026

      This is a common issue, if the system mailboxes are offline or not reachable. Technical background: login to ECP goes through OWA for authentication. OWA *always* requires a mailbox to sign-in. For Exchange Admins without mailboxes (not a mailbox user) or Exchange background tasks (e.g. mailbox move and migration), Exchange is silently utilizing one of the system mailboxes (arbitration mailboxes) for authentication.

      So, if Exchange admin users do not have a mailbox (which is Microsoft best-practice for security reasons) AND the system mailboxes aren't available/reachable for some reason, the Exchange admins won't be able to login to ECP! This an Exchange architecture dependency only little known within Microsoft support ;-)

      • Jpanski's avatar
        Jpanski
        Brass Contributor
        Aug 14, 2026

        I know this doesn't seem like the right place to ask this question, but since others have mentioned management accounts and possible mailbox requirements I will ask it here.  A year or so ago when we first installed Exchange SE, the Exchange administrator account that was used for installation had a mailbox created for it during install.  I have left it but always wondered if it's needed.  I figured it was since it was created but don't know what purpose it serves.  All other mailboxes are in the cloud (outside of system and arbitration mailboxes) so it bothers me :)  Is it safe to delete?  Thank you.

    • AAChicago's avatar
      AAChicago
      Brass Contributor
      Aug 13, 2026

      That is not our experience with the July update. Both new and existing management accounts that do not have an associated mailbox can access ECP fine.

    • Nino_Bilic's avatar
      Nino_Bilic
      Icon for Microsoft rankMicrosoft
      Aug 13, 2026

      I must say that I do not really understand what the problem is that you are having. Can you explain this scenario? What is the error?

      • tylerdami's avatar
        tylerdami
        Copper Contributor
        Aug 24, 2026

        Hey Nino, the issue was when we logged into ECP after the upgrade with our admin account, we received a continuous popup that would not allow us to click anything. On the event viewer side, we received this error: 

        Current user: 'REDACTED'
Web service call 'https://REDACTED:444/ecp/DDI/DDIService.svc/GetObject?ActivityCorrelationID=5850077c-6a3b-dc8c-bc2e-6c9d8901bcbb&workflow=GetForSDO&schema=DistributionGroups&msExchEcpCanary=VWZ9bOdNHESSe-_6OifEOBAydrKS-N4I9bN-LsvaD6G8aUA3th6rOPBClofLoRx1Tue7rlOAAfc.(https://REDACTED/ecp/DDI/DDIService.svc/GetObject?ActivityCorrelationID=5850077c-6a3b-dc8c-bc2e-6c9d8901bcbb&workflow=GetForSDO&schema=DistributionGroups&msExchEcpCanary=VWZ9bOdNHESSe-_6OifEOBAydrKS-N4I9bN-LsvaD6G8aUA3th6rOPBClofLoRx1Tue7rlOAAfc.)' failed with the following error:
System.ServiceModel.Dispatcher.NetDispatcherFaultException: The formatter threw an exception while trying to deserialize the message: There was an error while trying to deserialize parameter ECP:identity. The InnerException message was 'There was an error deserializing the object of type Microsoft.Exchange.Management.ControlPanel.Identity. End element 'RawIdentity' from namespace '' expected. Found element 'type' from namespace ''.'.  Please see InnerException for more details. ---> System.Runtime.Serialization.SerializationException: There was an error deserializing the object of type Microsoft.Exchange.Management.ControlPanel.Identity. End element 'RawIdentity' from namespace '' expected. Found element 'type' from namespace ''. ---> System.Xml.XmlException: End element 'RawIdentity' from namespace '' expected. Found element 'type' from namespace ''.
   at System.Xml.XmlExceptionHelper.ThrowXmlException(XmlDictionaryReader reader, String res, String arg1, String arg2, String arg3)
   at System.Xml.XmlExceptionHelper.ThrowEndElementExpected(XmlDictionaryReader reader, String localName, String ns)

        To stop this from happening, we needed to mailbox enable our Exchange Admin accounts. This corrected the issue. 

    • Nino_Bilic's avatar
      Nino_Bilic
      Icon for Microsoft rankMicrosoft
      Aug 12, 2026

      Hmmm weiird; never heard of this before; but it seems like it is good now. Must have been some sort of platform issue with RSS?

      • SvenLuders's avatar
        SvenLuders
        Brass Contributor
        Aug 12, 2026

        it looks like it has been fixed in the morning, because it is posted now. Maybe it was just a delay. 👌

  • Edisontts2026's avatar
    Edisontts2026
    Copper Contributor
    Aug 11, 2026

    Wow, that was fast—another Exchange security update already. I’m running Windows Server 2019 and haven’t installed the July Exchange Security Update yet. Can I proceed directly with the August update instead? Has anyone tried this so far?

    • NorbertFe's avatar
      NorbertFe
      Brass Contributor
      Aug 12, 2026

      You might wanna read the FAQ above. :)

  • update-failed-successfully's avatar
    update-failed-successfully
    Copper Contributor
    Aug 11, 2026

    Has the Pwn2Own 2026 (Orange Tsai) Exchange exploit been fixed yet? I haven't seen a CVE for it in the updates yet.

  • ManleyDOA's avatar
    ManleyDOA
    Brass Contributor
    Aug 11, 2026

    Just wanted to confirm if we performed the SettingOverride (https://support.microsoft.com/en-us/servicing/exchange/server/hotfix/2026/5105719) to fix wrapper messages in July, will this August SU installation overwrite or change that override, so we'd have to run it again?