Released: June 2026 Exchange Server Security Updates

We have applied the June SU and then blocked the mitigation, as we absolutely need images to be displayed in OWA. Unfortunately, after an hour, the mitigation comes back. We have issued the following commands:

Set-ExchangeServer -Identity SRV-EXCH01 -MitigationsBlocked @("M2")

Set-ExchangeServer -Identity SRV-EXCH02 -MitigationsBlocked @("M2")

To show which mitigations are now blocked, we issued the following command:

Get-ExchangeServer | Format-List Name,MitigationsApplied,MitigationsBlocked

This shows:

Name : SRV-EXCH01

MitigationsApplied : {PING1, M2.1.0}

MitigationsBlocked : {M2}

Name : SRV-EXCH02

MitigationsApplied : {PING1, M2.1.0}

MitigationsBlocked : {M2}

We then deleted the Mitigation on IIS level:

Copy-Item -Path "$env:ExchangeInstallPath\FrontEnd\HttpProxy\owa\web.config" -Destination "$env:ExchangeInstallPath\FrontEnd\HttpProxy\owa\web.config.$((Get-Date).ToString('yyyyMMdd-HHmmss')).bak"

Remove-WebConfigurationProperty -PSPath "IIS:\Sites\Default Web Site\owa" -Filter "system.webServer/rewrite/outboundRules" -Name "." -AtElement @{name="EEMS M2.1 OWA CSP - outbound"}

Remove-WebConfigurationProperty -PSPath "IIS:\Sites\Default Web Site\owa" -Filter "system.webServer/rewrite/outboundRules/preConditions" -Name "." -AtElement @{name="EEMS M2.1 OWA SPA HTML shell - precondition"}

This worked as now on the owa level, no URL re-write Rules are shown. But after an hour, the re-write rules come back. 

What are we missing?

Thanks.