Microsoft has released Security Updates (SUs) for vulnerabilities found in:
Exchange Server Subscription Edition (SE)
Exchange Server 2019
Exchange Server 2016
SUs are available for the f...
Updated Aug 28, 2026
Version 5.0
Blog Post
I've noticed my calendar app can't synchronise anymore with the published .ics link. The May update had a similar issue which returned error 500. Now apparently it detects User Agent strings and somehow doesn't allow Apple/Google Calendar or even Outlook classic. curl returns error 400 on the .ics link while it works when supplying a common UA string in the request.
Can we get a fix for this?
I have the same problem with a German Exchange Server SE. A user reported the problem last week and I could verify in the IIS logs that the problem started mid May and didn't got solved when I removed the mitigations after installing the July security update. And I have tripple checked the web.config.
The mitigations were applied by the EM service.
Addressing Exchange Server May 2026 vulnerability CVE-2026-42897 | Microsoft Community HubAddressing Exchange Server May 2026 vulnerability CVE-2026-42897 | Microsoft Community Hub
Following these instructions fixed the problem for use back in May. Undoing these with the August update doesn't fix the error 400 issue I've mentioned in another post.Thanks for the link but since the mitigation rules aren't needed anymore and also not present in my web.config I can't follow these instructions anymore. I also didn't notice the problem back in May. I only can see that the problem is there since mid May. And I also see ASP.NET events with the id 1309 and the exception type "OwaNotSupportedException"
Same here. Very annoying the published calendar doesn't work again!
How can you add a agent string filter, but not accept widely used calendar apps like Google Calendar and Outlook Classic. 🤦🏻♂️
- Nino_Bilic
Microsoft
Please make sure that CVE-2026-42897 mitigations were removed from the server. See the relevant section here: Released: July 2026 Exchange Server Security Updates | Microsoft Community Hub
We see this issue as well. Similar to the previous SU release.
- Nino_Bilic
This sounds like CVE-2026-42897 mitigation is still in place. Please see Released: July 2026 Exchange Server Security Updates | Microsoft Community Hub for tips on how to remove the mitigation IIS rules, however they were applied.
Sadly this is not the reason. The mitigations have been removed and verified:
C:\Program Files\Microsoft\Exchange Server\V15\Scripts>.\Get-Mitigations.ps1 Server : Redacted-EX01 Version : Version 15.2 (Build 2562.17) ID : PING1 Type : Ping Description : EEMS Heartbeat probe. Does not modify any exchange settings. Status : Applied
The following examples show that the user agent of a recent iOS client using the Calendar app gets an unexpected answer:curl.exe -k -v -A "iOS/26.6.1 (23G83) dataaccessd/1.0" "https://mail.contoso.com/owa/calendar/.../.../calendar.ics" returns < HTTP/1.1 302 Found < Content-Length: 161 .... <html><head><title>Object moved</title></head><body> <h2>Object moved to <a href="/owa/calendar/auth/errorFE.aspx?httpCode=500">here</a>.</h2> </body></html>
while a Chrome user agent returns:curl.exe -k -v -A "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.3" "https://mail.contoso.com/owa/calendar/.../.../calendar.ics" ... < HTTP/1.1 200 OK ... < Content-Length: 166992 < BEGIN:VCALENDAR METHOD:PUBLISH PRODID:Microsoft Exchange Server 2010 VERSION:2.0 ...Both using the same published .ics url.
