Blog Post

Exchange Team Blog

4 MIN READ

Released: November 2024 Exchange Server Security Updates

The_Exchange_Team

Microsoft

Nov 12, 2024

Update 11/27/2024: We have re-released November 2024 SUs. Please see this post for more information.

Microsoft has released Security Updates (SUs) for vulnerabilities found in:

Exchange Server 2019
Exchange Server 2016

SUs are available for the following specific versions of Exchange Server:

Exchange Server 2019 CU13 and CU14
Exchange Server 2016 CU23

The November 2024 SUs address vulnerabilities responsibly reported to Microsoft by security partners and found through Microsoft’s internal processes. Although we are not aware of any active exploits in the wild, our recommendation is to immediately install these updates to protect your environment.

These vulnerabilities affect Exchange Server. Exchange Online customers are already protected from the vulnerabilities addressed by these SUs and do not need to take any action other than updating any Exchange servers or Exchange Management tools workstations in their environment.

More details about specific CVEs can be found in the Security Update Guide (filter on Server Software under Product Family).

Improvements in Exchange Server AMSI integration

Starting with November 2024 SU release, we have extended the ability of products that use the Exchange Server AMSI integration to perform additional tasks on message bodies. The feature is disabled by default and can be enabled on a per protocol base. We recommend starting to enable this feature for a subset of services first, as it is possible that it could lead to performance issues. Additionally, we ask that you reach out to us if you experience any issues after enabling Exchange Server AMSI body scanning. Please see the documentation for more information on how this feature works and how it can be controlled.

Non-compliant RFC 5322 P2 FROM header detection

To address vulnerability CVE-2024-49040, a new feature was implemented to detect non-RFC 5322 compliant P2 FROM headers in incoming email messages. The P2 FROM header in an email is part of the message header that is displayed to the recipient's email client (for example, Outlook). It's the sender's email address or name (if the sender is internal) that appears in the From field when you view an email in your inbox. Please see the documentation for more information.

ECC certificate support improvements

November 2024 SU improves support for ECC certificates. ECC certificates can now be used on Edge Transport servers and can be bound to POP and IMAP service. Note that there is a change in how ECC Certificate support can be enabled. In the previous implementation, a New-SettingOverride was needed to enable the feature. Starting with the November 2024 SU, you need to create a registry value instead of the override. Please see the documentation for more information.

Known issues with this update

A known issue exists in both versions of the November 2024 Security Update. A Knowledge Base (KB) article has been published to describe the workaround for mitigating this issue. Please see the Time zone exception occurs after installing Exchange Server November 2024 SU (Version 1 or Version 2) KB for additional details.

Update installation

The following update paths are available:

Install the latest CU. Use the Exchange Update Wizard to choose your current CU and your target CU to get directions.
Inventory your Exchange Servers to determine which updates are needed using the Exchange Server Health Checker script. Running this script will tell you if any of your Exchange Servers are behind on updates (CUs, SUs, or manual actions).
Re-run the Health Checker after you install an SU to see if any further actions are needed.
If you encounter errors during or after installation of Exchange Server, run the SetupAssist script. If something does not work properly after updates, see Repair failed installations of Exchange Cumulative and Security updates.

FAQs

Our organization is in Hybrid mode with Exchange Online. Do we need to do anything?
Exchange Online is already protected, but this SU needs to be installed on your Exchange servers, even if they are used only for management purposes. If you change the auth certificate after installing an SU, you should re-run the Hybrid Configuration Wizard.

The last SU/HU we installed is a few months old. Do we need to install all SUs in order to install the latest one?
SUs are cumulative. If you are running a CU supported by the SU, you do not need to install all SUs or HUs in sequential order; simply install the latest SU. Please see this blog post for more information.

Do we need to install SUs on all Exchange Servers within our organization? What about ‘Management Tools only’ machines?
Our recommendation is to install SUs on all Exchange Servers and all servers and workstations running the Exchange Management Tools to ensure compatibility between management tools clients and servers. If you are trying to update the Exchange Management Tools in the environment with no running Exchange servers, please see this.

Documentation may not be fully available at the time this post is published.

This post might receive future updates; they will be listed here (if available).

Updates to this blog post:

11/28/2024: Added a new known issue
11/27/2024: Re-release of SUs to address known issues is now complete. Re-added download links.
11/14/2024: Added Known issues; removed the downloads temporarily.

The Exchange Server Team

Updated Nov 28, 2024

Version 6.0

Microsoft

Joined April 19, 2019

View Profile

Exchange Team Blog

You Had Me at EHLO.

ConsequenceWestern97
Copper Contributor
Nov 14, 2024
What's the timeline on fixing the issues where Transport Rules no longer work? Transport Rules are vital to the good operation of Exchange. This must be resolved quickly.
- Nino_Bilic
  Microsoft
  Nov 14, 2024
  Please see the update to the post now. We are temporarily removing the Nov 2024 SU downloads and will re-release it ASAP.
  - ConsequenceWestern97
    Copper Contributor
    Nov 14, 2024
    Thank you for your response. Once the update is re-released, will we be required to uninstall the current version and install the new version of the update? Or will the new version simply override the old version?
ROGER JANQUART
Copper Contributor
Nov 15, 2024
This might not be the right post to put this in, but this is an example of one of our concerns with the upcoming transition from Exchange 2019 to Exchange SE. That transition is leaving us very little time to prepare, when in the past we would typically wait until at least one service pack had been released and a majority of the issue had been resolved so that we could be confident to put the newest version into production. We are a large organization and not having proper time to prepare for the next release of Exchange is going to cause major impacts to our organization and we are also concerned the product may have unresolved major issues that will not have the proper time to be identified.
- Nino_Bilic
  Microsoft
  Nov 15, 2024
  We hear this concern but - IMO, there is nuance here. CU15 will release this CY; that will give you lots of time to get to "Exchange SE equivalent" testing in your organization. Indeed, there are still SUs that we will release, but we release SUs when needed; there could be an SU immediately after Exchange SE RTM, for example (and before CU1).
  
  The issue here is that we still release updates (usually SUs) with regressions. This is a problem that we have done a lot of work on and have added to variety of testing scenarios and improvements. But issues still happen. We realize that "release quality" (particularly for SUs) is something that we must do better on.
celeron
Copper Contributor
Nov 13, 2024
Great that we get a security update, but will CU15 be released this fall as expected?
- Nino_Bilic
  Microsoft
  Nov 13, 2024
  We still plan to release CU15 this calendar year, yes.
stefandechert
Brass Contributor
Nov 14, 2024
Nino_BilicDo you have any information or insights on the transport rule issue? There are some comments in this blog post as well as there are some others in the reddit patch tuesday megathread.
(people reporting that transport rules stop working with current SU. Transport service restart makes them work for a while, but after minutes/hours they stop working again).
Can you confirm?
- Nino_Bilic
  Microsoft
  Nov 14, 2024
  Stay tuned; we are investigating this.
- Nino_Bilic
  Microsoft
  Nov 14, 2024
  Please see the update to the post now. We are temporarily removing the Nov 2024 SU downloads and will re-release it ASAP.
  - MohammadNoor80
    Copper Contributor
    Nov 14, 2024
    We have installed this SU unfortunately we are facing problems with transport rules.. what I should do till the next release?
AlexanderP
Copper Contributor
Nov 14, 2024
Hi, latest Security Update for exchange KB5044062 - broke "MAIL FLOW" rules.
Exchange on Prem. win. server 2019 / exchange 2019 - all worked Ok before update, after tuesday update - MAIL FLOW stopped working. enabling/disabling rules - temporally makes everything work again. after some time (couple of hours) it stops again. any suggestions? (except for uninstall update)
- bc90
  Copper Contributor
  Nov 14, 2024
  Other's have noticed this problem too. Me also.
  Restarting the Exchange Transport service makes it work for a while, then it stops again. So, I decided to make a scheduled task to simply restart the transport service that runs every 30mins. That seems to mitigate the issue and keep the rules working without requiring repeated manual actions. Perhaps that will work for you, until this can be corrected.
  - MohammadNoor80
    Copper Contributor
    Nov 15, 2024
    I did so ," a scheduled task restarts the transport rule service each 30 mins", waiting for the new release
    the batch runs in a scheduled task /script code is:
    @echo off
    echo Restarting MSExchangeTransport service...
    net stop MSExchangeTransport >> C:\Temp\service_restart_log.txt 2>&1
    timeout /t 10 /nobreak >nul
    net start MSExchangeTransport >> C:\Temp\service_restart_log.txt 2>&1
    echo MSExchangeTransport service restarted. >> C:\Temp\service_restart_log.txt
- MohammadNoor80
  Copper Contributor
  Nov 14, 2024
  Same Scenario for me,also either I restart transport service or the server itself.
- LFA
  Copper Contributor
  Nov 24, 2024
  Same here, I Unstall the updates to solve the problem, waiting for another patch from Microsoft.
ASysOP
Copper Contributor
Nov 15, 2024
Applied update last night... transport rules are indeed broken but mailflow was still working minus rules. Just uninstalled and transport rules are working again. Thanks again Microsoft for taking my money 1700+ E5 licences + hundreds of CALS for Exchange 2019. Thanks for taking my money and using it on dev and test.
Awesomeman
Copper Contributor
Nov 14, 2024
Anyone else seeing problems with transport rules/mail flow rules failing to fire after this update?
- 8839
  Copper Contributor
  Nov 14, 2024
  Yes. After restarting the server or re-creating the rule, the mail flow rule works for 30-40 minutes, then it stops. This happens both on a test server and in a live environment - Exchange 2019 CU14 + november SU.
- sjansen
  Brass Contributor
  Nov 15, 2024
  We saw a hugh amount of application errors of the malware engine on our patched exchange server, as this is only a relay for outbound connection, we disabled it temporarly with "Set-MalwareFilteringServer ExchangeServerName -BypassFiltering $true", after restarting the transport, mail is flowing again (for around 2h now).
bc90
Copper Contributor
Nov 14, 2024
Since the update, after a few hours the Mailflow Rules all stop working completely. The Transport Rule Agent is showing as still enabled too and the rules remain active. They just don't apply at all.
So far, a workaround is to restart the Transport service and they work again, but then the rules will stop again in an hour or two and I'll have to restart the service again.
Anyone else experiencing this? Perhaps the update just didn't install properly for us or something else is going on that I'm missing.
- bc90
  Copper Contributor
  Nov 14, 2024
  I created a scheduled task to run every 30mins to restart the Transport Service and that seems to mitigate the problem for now, until this can be fixed. Exchange 2016 CU23 SU14, non-English.
  - wheeler
    Copper Contributor
    Nov 15, 2024
    Are you able to share how you scheduled this? Every option we have tried so far fails in different manners.
- Awesomeman
  Copper Contributor
  Nov 14, 2024
  Yes, transport rules/mail flow rules are failing for us as well since the update.
  Everything seems to have installed well for us.
Michael_Wiskman
Brass Contributor
Nov 18, 2024
Is there a timeline for when the new updated SU will be released? After all, CVE-2024-49040 was one of the reasons the November 2024 SU was released, and now it is known in the wild.
- Nino_Bilic
  Microsoft
  Nov 18, 2024
  We understand and are working to re-release the update ASAP. Sorry, I do not have a date to share.
  - PankajNTT
    Brass Contributor
    Nov 18, 2024
    We do not have Transport Rules and DLP Rules on Exchange servers, hope it will not impact us if we install Nov Security update.
    Hoping it will not impact existing Transport agents also.
    we do use DLP rules on O365 but I believe this is not related to this.
    Also, I dont find Nov Security update to download anywhere now.
4ppl3c0r3
Iron Contributor
Nov 27, 2024
Exchange 2019 CU14 Apr24HU -> Exchange 2019 CU14 Nov24SUv2 updated successfully.
Thank you!