Our takeMicrosoft Exchange Server 2016 CU23 prior to 15.01.2507.075 and 2019 CU14/15 prior to the listed builds contain a vulnerability disclosed today. Patch immediately if you run on-prem Exchange.Cyber Resilience desk
Sources (1)
- cccs · cccs
What this means for you — Security leader:Apply the October 2026 Exchange cumulative updates: CU23 for 2016 (to 15.01.2507.075 or later), CU14 for 2019 (to 15.02.1544.048 or later), and CU15 for 2019 (to 15.02.1748.053 or later).
What this means for you — Lean IT orgs:If you run your own Microsoft Exchange Server 2016 or 2019, install the latest cumulative update released in October 2026 as soon as possible.
What this means for you — MSP:Check every client running on-premises Exchange 2016 CU23 or Exchange 2019 CU14/CU15; deploy the October 2026 cumulative updates to reach the fixed builds listed in AV26-1001.
What this means for you — Researcher:Microsoft advisory AV26-1001 discloses a security vulnerability in older Exchange 2016/2019 cumulative updates; update to the October 2026 builds immediately.