Microsoft has released Security Updates (SUs) for vulnerabilities found in:
- Exchange Server Subscription Edition (SE)
- Exchange Server 2019
- Exchange Server 2016
SUs are available for the following specific versions of Exchange Server:
- Exchange SE RTM
- Exchange Server 2019 CU14 and CU15 (to access, organization must be enrolled into the Period 2 ESU program)
- Exchange Server 2016 CU23 (to access, organization must be enrolled into the Period 2 ESU program)
The July 2026 SUs address vulnerabilities responsibly reported to Microsoft by security partners and found through Microsoft’s internal processes.
These vulnerabilities affect Exchange Server. Exchange Online customers are already protected from the vulnerabilities addressed by these SUs and do not need to take any action other than updating any Exchange servers or Exchange Management tools workstations in their environment.
More details about specific CVEs can be found in the Security Update Guide (filter on ‘Server Software’ under Product Family for Exchange SE and ‘ESU’ under Product Family for Exchange 2016 and 2019).
Check for presence of legacy Exchange security groups
While not directly related to our July 2026 SU release, we wanted to call out that Exchange Health Checker script will now also check for the presence of very old, deprecated Exchange Server security groups, namely Exchange Domain Servers and Exchange Enterprise Servers. Those groups have been deprecated since Exchange 2007, should not be in use, and should be deleted as they might provide more permissions than modern Exchange security groups. Please see related documentation here.
Customers who have removed last on-premises Exchange Server from their organizations should also check for the presence of those groups and delete them to help prevent their possible abuse. Note that if you no longer have any Exchange servers on premises, you might want to perform a more comprehensive Active Directory cleanup as per this article.
Remove CVE-2026-42897 mitigations after installation
Installing the July 2026 update does not automatically remove already applied CVE-2026-42897 mitigations. Therefore, once you install July SU, you should:
If mitigation was applied using Exchange Emergency Mitigation (EM) Service:
If mitigation was applied using the downloadable EOMT script https://aka.ms/UnifiedEOMT:
Exchange 2016 and 2019 updates are available only under the Period 2 ESU program
Exchange Server 2016 and 2019 are out of support. Only customers who enrolled in the Period 2 Extended Security Update (ESU) program are eligible to receive Exchange Server 2016 and 2019 security updates released between May and October 2026.
If you are not part of the Period 2 ESU program, migrate to Exchange Server Subscription Edition (SE) to keep receiving the latest security updates.
If you have already purchased the Period 2 ESU and need information on accessing the latest Security Updates, please contact us by sending an email to ExchangeandSfBServerESUInquiry@service.microsoft.com.
Known issues with this release
Update installation
The following update paths are available:
- Inventory your Exchange Servers to determine which updates are needed using the Exchange Server Health Checker script. Running this script will tell you if any of your Exchange Servers are behind on updates (CUs, SUs, or manual actions).
- Install the latest CU. Use the Exchange Update Wizard to choose your current CU and your target CU to get directions.
- Re-run the Health Checker after you install an update to see if any further actions are needed.
- After setup is completed, please reboot the server and check that all Exchange services have started properly. If some services are in a disabled state, that indicates that something interrupted installation of the update. Please see the Workaround 1 in this article.
- If you encounter errors during or after installation of Exchange Server, run the SetupAssist script. If something does not work properly after updates, see Repair failed installations of Exchange Cumulative and Security updates. Also please see File version error when you try to install Exchange Server updates.
FAQs
When CVE-2026-42897 mitigation was released, there were several reported known issues. Are those addressed in this update?
Yes, when July 2026 SU is installed and mitigation is removed, mitigation known issues should be resolved too.
If we update some of our servers but cannot update others, can servers that will not receive update stay with CVE-2026-42897 mitigations? Is it OK to have some servers updated and some still using mitigations?
You can continue using mitigations on any servers that you cannot update to July 2026 SU (or newer). But note that known issues from mitigations will continue to apply to those servers. Additionally, after applying this update, Office Online Server (OOS) integration with Exchange Server might not function as expected until all Exchange servers in the organization have been updated.
Our organization is in Hybrid mode with Exchange Online. Do we need to do anything?
Exchange Online is already protected, but this SU needs to be installed on your Exchange servers, even if they are used only for management purposes. If you change the auth certificate after installing an SU, you should re-run the Hybrid Configuration Wizard.
The last SU/HU we installed is a few months old. Do we need to install all SUs in order to install the latest one?
SUs are cumulative. If you are running a CU supported by the SU, you do not need to install all SUs or HUs in sequential order; simply install the latest SU. Please see this blog post for more information.
Do we need to install SUs on all Exchange Servers within our organization? What about ‘Management Tools only’ machines?
Our recommendation is to install SUs on all Exchange Servers and all servers and workstations running the Exchange Management Tools to ensure compatibility between management tools clients and servers. If you are trying to update the Exchange Management Tools in the environment with no running Exchange servers, please see this.
Our organization does not have the Exchange 2016 and 2019 Period 2 ESU. How can we get current Exchange 2016 or 2019 updates?
Since Exchange 2016 and 2019 are now out of support, only customers who have enrolled into the Period 2 ESU program (which is valid between May and October 2026) can obtain Exchange 2016 or 2019 updates released after May 2026. For all other customers still running Exchange 2016 or 2019, we recommend that you upgrade your organization to Exchange SE as soon as possible.
Documentation may not be fully available at the time this post is published.
This post might receive future updates; they will be listed here (if available).
The Exchange Server Team
