Blog Post

Exchange Team Blog
6 MIN READ

Released: June 2026 Exchange Server Security Updates

The_Exchange_Team's avatar
The_Exchange_Team
Platinum Contributor
Jun 09, 2026

Microsoft has released Security Updates (SUs) for vulnerabilities found in:

  • Exchange Server Subscription Edition (SE)
  • Exchange Server 2019
  • Exchange Server 2016

SUs are available for the following specific versions of Exchange Server:

The June 2026 SUs address vulnerabilities responsibly reported to Microsoft by security partners and found through Microsoft’s internal processes as well as CVE-2026-42897 that we announced: Addressing Exchange Server May 2026 vulnerability CVE-2026-42897 | Microsoft Community Hub.

These vulnerabilities affect Exchange Server. Exchange Online customers are already protected from the vulnerabilities addressed by these SUs and do not need to take any action other than updating any Exchange servers or Exchange Management tools workstations in their environment.

More details about specific CVEs can be found in the Security Update Guide (filter on ‘Server Software’ under Product Family for Exchange SE and ‘ESU’ under Product Family for Exchange 2016 and 2019).

Update to ensure continued function of Exchange Emergency Mitigation (EM) and Feature Flighting services

Due to service-side change, the Exchange Emergency Mitigation (EM) and Exchange Flighting services will be unable to use configuration files released in July 2026 or later, unless Exchange is updated to June 2026 update (or newer). Any mitigations already downloaded and applied will keep working, but servers will not be able to use any new mitigations starting in July 2026 unless updates are installed. Please see Exchange mitigation and flighting services fail due to "Unknown Issuer" error for more details.

CVE-2026-42897 mitigations after installation

As part of our ongoing efforts to strengthen security and improve defenses across environments, we continue to enhance protections for cross-site scripting attacks. We recommend that customers keep CVE-2026-42897 mitigation in place. The mitigation provides an additional layer of defense and helps ensure continuous protection as further improvements are released. Additional updates will be shared as they become available - now available, please see Released: July 2026 Exchange Server Security Updates | Microsoft Community Hub.

Installing the June 2026 update does not automatically remove already applied CVE-2026-42897 mitigations. Therefore, if you choose to remove mitigations after installation, you should:

If mitigation was applied using Exchange Emergency Mitigation (EM) Service:

  1. Block the mitigation M2.1.0 from re-applying. Because of our recommendation to keep the CVE-2026-42897 mitigation in place, we are not yet updating the mitigation to not apply to servers that are updated to June 2026 SU. Therefore, at this time, you must block the mitigation from re-applying first.
  2. Remove the mitigation M2 IIS rules.

If mitigation was applied using the downloadable EOMT script https://aka.ms/UnifiedEOMT:

  1. Roll back the mitigation.

Exchange 2016 and 2019 updates are available only under the Period 2 ESU program

Exchange Server 2016 and 2019 are out of support. Only customers who enrolled in the Period 2 Extended Security Update (ESU) program are eligible to receive Exchange Server 2016 and 2019 security updates released between May and October 2026.

If you are not part of the Period 2 ESU program, migrate to Exchange Server Subscription Edition (SE) to keep receiving the latest security updates.

If you have already purchased the Period 2 ESU and need information on accessing the latest Security Updates, please contact us by sending an email to ExchangeandSfBServerESUInquiry@service.microsoft.com.

Known issues with this release

Update installation

The following update paths are available:

FAQs

When CVE-2026-42897 mitigations were released, there were several reported known issues. Are those solved in the CVE-2026-42897 fix (June 2026 SU)?
Yes, when June 2026 SU is installed and mitigation is removed, known issues should be resolved too. But note that mitigations do not get removed automatically after installation of the SU (and we recommend that you keep then enabled for a little while longer).

If we update some of our servers but cannot update others, can servers that will not receive update stay with CVE-2026-42897 mitigations? Is it OK to have some servers updated and some still using mitigations?
You can continue using mitigations on any servers that you cannot update to June 2026 SU (or newer). But note that known issues from mitigations will continue to apply to those servers. Additionally, after applying this update, Office Online Server (OOS) integration with Exchange Server might not function as expected until all Exchange servers in the organization have been updated.

We updated our servers to June 2026 (or newer) update, but we still have trouble with known issues caused by mitigations. Why is this?
Installing the June 2026 (or newer) update does not automatically remove mitigations. Please see the post above. Currently, we recommend that mitigations stay in place but they can be removed as per the above.

Our organization is in Hybrid mode with Exchange Online. Do we need to do anything?
Exchange Online is already protected, but this SU needs to be installed on your Exchange servers, even if they are used only for management purposes. If you change the auth certificate after installing an SU, you should re-run the Hybrid Configuration Wizard.

The last SU/HU we installed is a few months old. Do we need to install all SUs in order to install the latest one?
SUs are cumulative. If you are running a CU supported by the SU, you do not need to install all SUs or HUs in sequential order; simply install the latest SU. Please see this blog post for more information.

Do we need to install SUs on all Exchange Servers within our organization? What about ‘Management Tools only’ machines?
Our recommendation is to install SUs on all Exchange Servers and all servers and workstations running the Exchange Management Tools to ensure compatibility between management tools clients and servers. If you are trying to update the Exchange Management Tools in the environment with no running Exchange servers, please see this.

Our organization does not have the Exchange 2016 and 2019 Period 2 ESU. How can we get current Exchange 2016 or 2019 updates?
Since Exchange 2016 and 2019 are now out of support, only customers who have enrolled into the Period 2 ESU program (which is valid between May and October 2026) can obtain Exchange 2016 or 2019 updates released after May 2026. For all other customers still running Exchange 2016 or 2019, we recommend that you upgrade your organization to Exchange SE as soon as possible.

Documentation may not be fully available at the time this post is published.

Significant updates to this post:

The Exchange Server Team

Updated Jul 14, 2026
Version 6.0
administration
announcements
exchange 2016
exchange 2019
exchange se
on premises
security
setup

69 Comments

Show More
  • broland's avatar
    broland
    Iron Contributor
    Jun 09, 2026

    I hate to be a nitpicker but the FAQ "When CVE-2026-42897 mitigations were released, there were several reported known issues. Are those solved in the CVE-2026-42897 fix (June 2026 SU)?" I would respectfully say the answer is "no."  You say they are, as long as you remove the mitigations.  Well if I remove the mitigations without the security update they are also "solved" by that logic.  But you're also recommending leaving the mitigations in place (despite it allegedly being fixed), which means the known issues will continue to exist.  I don't know maybe it's just me.

     

    Also KB5094139 states that "The fix for CVE-2026-45583 is not included in the Security Update, please follow the instructions mentioned in the CVE documentation to address this vulnerability." but when I click on the CVE documentation it seems to suggest the fix is to install the Security Update and manually download and replace some Public Folders scripts?  Is that right?

    • Nino_Bilic's avatar
      Nino_Bilic
      Icon for Microsoft rankMicrosoft
      Jun 09, 2026

      Your first point is fair as it might sound like we want to keep the cake and eat it too. But I want to be clear: June 2026 fix DOES fix CVE-2026-42897. The CVE itself was updated to say that this update is the fix. Install it and it is fixed.

      But indeed, we are doing some more work in adjacent areas. We are recommending keeping mitigation out of abundance of caution. We are not aware of any new ongoing attack or anything like that, but there is more we want to do here. We also know that some of our customers are really hurting due to mitigation known issues and that is why we are providing options (and information how to block/remove mitigations, if so desired, after installing the update). We would not tell you this if we did not fix CVE-2026-42897.

      Your interpretation of CVE-2026-45583 - Security Update Guide - Microsoft - Microsoft Exchange Server Remote Code Execution Vulnerability is right. The issue with "built-in scripts" is something that we cannot truly fix outside of the Cumulative Update (which June 2026 release is not) so we are asking folks who need the scripts to download them from GitHub. In fact, we will remove those scripts from installation media in a future CU.

      • broland's avatar
        broland
        Iron Contributor
        Jun 10, 2026

        Thanks Nino_Bilic​.  My intention was not to be pedantic, rather I just wasn't entirely clear on either point. As always, the Exchange team is awesome.

  • Pankaj9873's avatar
    Pankaj9873
    Brass Contributor
    Jun 09, 2026

    Nino_Bilic​ Hello, we have mitigation applied by Exchange Emergency Mitigation (EM) Service, and we have not faced any issue after mitigation as we only used for Outbound SMTP relay and no mailboxes hosted. 

    Do we still need to follow below instructions to remove mitigations? it does not remove automatically after installation? or if we dont remove will there be any issue to the exchange functionality ?

    1. https://learn.microsoft.com/en-us/exchange/plan-and-deploy/post-installation-tasks/security-best-practices/exchange-emergency-mitigation-service#blocking-or-removing-mitigations. Because of our recommendation to keep the CVE-2026-42897 mitigation in place, we are not yet updating the mitigation to not apply to servers that are updated to June 2026 SU. Therefore, at this time, you must block the mitigation from re-applying first.
    2. https://learn.microsoft.com/Exchange/plan-and-deploy/post-installation-tasks/security-best-practices/exchange-emergency-mitigation-service#rollback-procedures-for-released-mitigations.

    Please advise.

    • Nino_Bilic's avatar
      Nino_Bilic
      Icon for Microsoft rankMicrosoft
      Jun 09, 2026

      You don't need to do anything with mitigations in that case, no. Once you install the fix, you will have the fix AND mitigations (which are no removed automatically) - but that's OK as they are not blocking anything for your scenario.

      • Pankaj9873's avatar
        Pankaj9873
        Brass Contributor
        Jun 09, 2026

        Thank you! so, i just need to install June SU and we are all set?