Microsoft has released Security Updates (SUs) for vulnerabilities found in:
- Exchange Server Subscription Edition (SE)
SUs are available for the following specific versions of Exchange Server:
The November 2026 SUs address vulnerabilities responsibly reported to Microsoft by security partners and found through Microsoft’s internal processes.
These vulnerabilities affect Exchange Server. Exchange Online customers are already protected from the vulnerabilities addressed by these SUs and do not need to take any action other than updating any Exchange servers or Exchange Management tools workstations in their environment.
More details about specific CVEs can be found in the Security Update Guide (filter on ‘Server Software’ under Product Family for Exchange SE).
Looking for Exchange 2016 and 2019 information?
Exchange Server 2016 and 2019 are no longer tested for vulnerabilities and there are no updates released. If you are using those versions of Exchange, you should consider them permanently vulnerable and should upgrade your organization immediately.
Issues resolved
- Exchange servers may become unstable after installation of October 2026 Windows updates | Microsoft Community Hub – to address the issue where any version of Exchange might be impacted by instability after installation of Windows Server October 2026 updates, please install November 2026 updates for Windows Server. Customers who have created the registry key to address the issue in October can leave the registry key in place, but the key is not required once November 2026 Windows Server updates are installed. It does not matter in which order November 2026 Exchange Server vs. Windows Server updates are installed.
Update installation
The following update paths are available:
- Inventory your Exchange Servers to determine which updates are needed using the Exchange Server Health Checker script. Running this script will tell you if any of your Exchange Servers are behind on updates (CUs, SUs, or manual actions).
- After setup is completed, please reboot the server and check that all Exchange services have started properly. If some services are in a disabled state, that indicates that something interrupted installation of the update. Please see the Workaround 1 in this article.
- If you encounter errors during or after installation of Exchange Server, run the SetupAssist script. If something does not work properly after updates, see Repair failed installations of Exchange Cumulative and Security updates. Also please see File version error when you try to install Exchange Server updates.
FAQs
Our organization is in Hybrid mode with Exchange Online. Do we need to do anything?
Exchange Online is already protected, but this SU needs to be installed on your Exchange servers, even if they are used only for management purposes. If you change the auth certificate after installing an SU, you should re-run the Hybrid Configuration Wizard.
The last SU/HU we installed is a few months old. Do we need to install all SUs in order to install the latest one?
SUs are cumulative. If you are running a CU supported by the SU, you do not need to install all SUs or HUs in sequential order; simply install the latest SU. Please see this blog post for more information.
Do we need to install SUs on all Exchange Servers within our organization? What about ‘Management Tools only’ machines?
Our recommendation is to install SUs on all Exchange Servers and all servers and workstations running the Exchange Management Tools to ensure compatibility between management tools clients and servers. If you are trying to update the Exchange Management Tools in the environment with no running Exchange servers, please see this.
We installed an Exchange SU or HU update and are running Windows Server 2025. How do we uninstall updates as they are not listed on Windows Server 2025?
We do not recommend uninstalling Security Updates. But see Can't view or uninstall Exchange security or hotfix updates in Control Panel on Windows Server 2025 | Microsoft Support.
Our organization still uses Exchange 2016 or 2019. After October 2026, we see no updates or vulnerabilities mentioned for those versions. Are they not vulnerable?
Exchange 2016 and 2019 are out of support, and the Period 2 ESU program ended. Exchange Server 2016 and 2019 are no longer tested for vulnerabilities and there are no updates released. If you are using those versions of Exchange, you should consider them permanently vulnerable and should upgrade your organization immediately.
Documentation may not be fully available at the time this post is published.
This post might receive future updates; they will be listed here (if available).
The Exchange Server Team
