Blog Post

Exchange Team Blog
4 MIN READ

Released: August 2026 Exchange Server Security Updates

The_Exchange_Team's avatar
The_Exchange_Team
Platinum Contributor
Aug 11, 2026
Microsoft has released Security Updates (SUs) for vulnerabilities found in: Exchange Server Subscription Edition (SE) Exchange Server 2019 Exchange Server 2016 SUs are available for the f...
Updated Sep 08, 2026
Version 7.0
administration
announcements
exchange 2016
exchange 2019
exchange se
on premises
security
setup
Jacobo_l's avatar
Jacobo_l
Copper Contributor
Aug 25, 2026

We are experiencing exactly the same issue in our environment. Calendar subscriptions that were previously working can no longer synchronize using the published .ics URL.

We have also observed that requests from Apple Calendar are being rejected, while the same URL works when accessed using a browser-like User-Agent string.

Additionally, we have identified a difference in behavior depending on the User-Agent being used. When the request is sent with the Apple Calendar User-Agent (iOS/26.5+(23F77)+dataaccessd/1.0), the Exchange server responds with HTTP 302. However, when the same .ics URL is requested using other User-Agent strings, the Exchange server responds with HTTP 200 and the calendar updates correctly.
These calendar subscriptions are critical to our organization.

  • Nino_Bilic's avatar
    Nino_Bilic
    Icon for Microsoft rankMicrosoft
    Aug 25, 2026

    We now have a bug on this; I added a Known Issue and a workaround to the blog post above.

    • timvh's avatar
      timvh
      Copper Contributor
      Aug 26, 2026

      Adding a URL rewrite to the default web site web.config allows users to keep using the same URL.

          <system.webServer>
        <rewrite>
            <rules>
                <rule name="Calendar.ics August26SU workaround">
                    <match url="^owa/calendar/(.+)/calendar\.ics$" />
                    <conditions>
                        <add input="{QUERY_STRING}" pattern="(^|&)layout=" negate="true" />
                    </conditions>
                    <action type="Rewrite" url="owa/calendar/{R:1}/calendar.ics?layout=premium" logRewrittenUrl="true" />
                </rule>
            </rules>
        </rewrite>
    </system.webServer>

      Or using the IIS Manager:
      Sites -> Default Web Site -> URL Rewrite -> Add Rule -> Blank rule -> Match URL pattern:

      Matches the pattern using Regular exxpressions
Pattern: ^owa/calendar/(.+)/calendar\.ics$

       -> Conditions -> Add:

      Condition input: {QUERY_STRING}
Does not match the pattern
Pattern: (^|&)layout=

      Action ->

      Action type: Rewrite
Rewrite URL: owa/calendar/{R:1}/calendar.ics?layout=premium

      Save and the workaround should be active without users having to use altered URL's