Released: June 2021 Quarterly Exchange Updates

I have an O365 Hybrid-Setup with Exchange 2016 CU18 and Exchange 2019 CU9 on premises in coexistence.

Today I tried to install either CU10 or CU21, but neither succeeded. Setup fails while accessing adminsdholder object in AD:

[06/30/2021 16:04:08.0020] [2] Used domain controller DC1.mydomain.local to read object CN=Delegated Setup,OU=Microsoft Exchange Security Groups,DC=mydomain,DC=local.
[06/30/2021 16:04:08.0035] [2] Used domain controller DC1.mydomain.local to read object DC=mydomain,DC=local.
[06/30/2021 16:04:08.0098] [2] Used domain controller DC1.mydomain.local to read object CN=AdminSDHolder,CN=System,DC=mydomain,DC=local.
[06/30/2021 16:04:08.0113] [2] [ERROR] Object reference not set to an instance of an object.
[06/30/2021 16:04:08.0113] [2] [WARNING] An unexpected error has occurred and a Watson dump is being generated: Object reference not set to an instance of an object.
[06/30/2021 16:04:08.0301] [1] The following 1 error(s) occurred during task execution:
[06/30/2021 16:04:08.0301] [1] 0. ErrorRecord: Object reference not set to an instance of an object.
[06/30/2021 16:04:08.0301] [1] 0. ErrorRecord: System.NullReferenceException: Object reference not set to an instance of an object.
at Microsoft.Exchange.Management.Tasks.SetupTaskBase.LogReadObject(ADRawEntry obj)
at Microsoft.Exchange.Management.Tasks.InitializeDomainPermissions.InternalProcessRecord()
at Microsoft.Exchange.Configuration.Tasks.Task.<ProcessRecord>b__91_1()
at Microsoft.Exchange.Configuration.Tasks.Task.InvokeRetryableFunc(String funcName, Action func, Boolean terminatePipelineIfFailed)
at Microsoft.Exchange.Configuration.Tasks.Task.ProcessTaskStage(TaskStage taskStage, Action initFunc, Action mainFunc, Action completeFunc)
at Microsoft.Exchange.Configuration.Tasks.Task.ProcessRecord()
at System.Management.Automation.CommandProcessor.ProcessRecord()
[06/30/2021 16:04:08.0301] [1] [ERROR] The following error was generated when "$error.Clear();
$createTenantRoot = ($RoleIsDatacenter -or $RoleIsPartnerHosted);
$createMsoSyncRoot = $RoleIsDatacenter;

#$RoleDatacenterIsManagementForest is set only in Datacenter deployment; interpret its absense as $false
[bool]$isManagementForest = ($RoleDatacenterIsManagementForest -eq $true);

if ($RolePrepareAllDomains)
{
initialize-DomainPermissions -AllDomains:$true -CreateTenantRoot:$createTenantRoot -CreateMsoSyncRoot:$createMsoSyncRoot -IsManagementForest:$isManagementForest;
}
elseif ($RoleDomain -ne $null)
{
initialize-DomainPermissions -Domain $RoleDomain -CreateTenantRoot:$createTenantRoot -CreateMsoSyncRoot:$createMsoSyncRoot -IsManagementForest:$isManagementForest;
}
else
{
initialize-DomainPermissions -CreateTenantRoot:$createTenantRoot -CreateMsoSyncRoot:$createMsoSyncRoot -IsManagementForest:$isManagementForest;
}
" was run: "System.NullReferenceException: Object reference not set to an instance of an object.
at Microsoft.Exchange.Management.Tasks.SetupTaskBase.LogReadObject(ADRawEntry obj)
at Microsoft.Exchange.Management.Tasks.InitializeDomainPermissions.InternalProcessRecord()
at Microsoft.Exchange.Configuration.Tasks.Task.<ProcessRecord>b__91_1()
at Microsoft.Exchange.Configuration.Tasks.Task.InvokeRetryableFunc(String funcName, Action func, Boolean terminatePipelineIfFailed)
at Microsoft.Exchange.Configuration.Tasks.Task.ProcessTaskStage(TaskStage taskStage, Action initFunc, Action mainFunc, Action completeFunc)
at Microsoft.Exchange.Configuration.Tasks.Task.ProcessRecord()
at System.Management.Automation.CommandProcessor.ProcessRecord()".
[06/30/2021 16:04:08.0301] [1] [ERROR] Object reference not set to an instance of an object.
[06/30/2021 16:04:08.0301] [1] [ERROR-REFERENCE] Id=DomainGlobalConfig___27a706ffe123425f9ee60cb02b930e81 Component=EXCHANGE14:\Current\Release\Shared\Datacenter\Setup
[06/30/2021 16:04:08.0301] [1] Setup is stopping now because of one or more critical errors.
[06/30/2021 16:04:08.0301] [1] Finished executing component tasks.

Domain- and Forest level was W2012R2, I raised it to W2016. Permissions for the admin user is also fine, I also tried with the built-in Admin. PrepareSchema succeeded already.

Any ideas?