Messageware

08/12/2026

📢 Microsoft has released the August 2026 Exchange Server Security Updates.

Key points:
• Security updates are available for Exchange Server SE, 2019 and 2016
• CVE-2026-62914 is addressed
• OWA Light is permanently disabled starting with this update
• Exchange 2016 and 2019 updates require enrolment in the Period 2 ESU programme
• Hybrid environments with on-premises Exchange servers still need to apply the update

Read more: https://www.messageware.com/patch-tuesday-august-2026-exchange-server-security-updates/

Microsoft released August 2026 Exchange Server security updates addressing multiple CVEs including CVE-2026-62913, CVE-2026-62914 and CVE-2026-62910

08/06/2026

Messageware has released Server Threat Guard v2.9

What's new:

· Clearer separation between security and health reporting
· Expanded IIS configuration change detection
· Smarter health alert throttling
· Improved reporting to help IT and SecOps teams focus on what matters most

Free, fully supported production trials: https://www.messageware.com/server-threat-guard/

Secure Microsoft Windows Servers with threat detection & health monitoring to rapidly identify zero-day attacks, exploits, and instability.

06/11/2026

📢 Microsoft released the June 2026 Exchange Server Security Updates on June 8, 2026.

Affected versions:
• Exchange Server SE
• Exchange Server 2019 (ESU Period 2 enrollees only)
• Exchange Server 2016 (ESU Period 2 enrollees only)

CVEs addressed:
• CVE-2026-42897 — cross-site scripting (XSS) vulnerability
• Additional vulnerabilities identified through Microsoft's internal security processes

Critical deadline — July 2026:
Servers not running the June 2026 SU or newer will lose access to Emergency Mitigation (EM) service configurations and Feature Flighting updates starting July 2026.

ESU note:
Exchange 2016 and 2019 SUs are restricted to organisations enrolled in the Period 2 ESU program (May–October 2026). Organisations not enrolled should prioritise migration to Exchange Server SE.

CVE-2026-42897 mitigation:
Existing mitigations are not automatically removed by the SU. Microsoft advises keeping them in place until further notice.

Read more: https://www.messageware.com/patch-tuesday-exchange-server-security-updates-for-june-2026/

Microsoft released June 2026 Exchange Server security updates addressing CVE-2026-42897, a critical Outlook Web Access vulnerability.

05/28/2026

🚀 Server Threat Guard v2.8 is here.

We're excited to announce the latest release of Server Threat Guard (STG). v2.8 expands beyond real-time security threat detection into proactive server health monitoring, helping IT and SecOps teams shift from reacting to outages to preventing them.

What's new in v2.8:

🔍 Real-time health event detection for critical and error-level conditions
📊 A centralized health dashboard for system status at a glance
🔔 Intelligent alerting and daily health summaries, designed to cut alert fatigue
🧠 Context-aware insights that separate routine activity from issues that need attention

Built for Windows Servers, on-premises and in the cloud.

Available now, with free, fully supported production trials. 👇 https://pages.messageware.com/get-protected-with-server-threat-guard

05/15/2026

🚨 Active Exploit Alert: CVE-2026-42897 — Microsoft Exchange Server. A high-severity XSS vulnerability in Exchange Server 2016, 2019, and SE is being actively exploited via crafted emails in Outlook Web Access.

Key facts:
• CVSS score: 8.1 (High)
• No permanent patch yet — mitigation available via EEMS or EOMT
• Exchange Online users are not affected

If your organization runs on-premises Exchange, check your mitigation status now.

Details here: https://www.messageware.com/critical-exchange-server-vulnerability-cve-2026-42897/

CVE-2026-42897 is an actively exploited Exchange Server vulnerability. Learn what's affected, the current risk level, and how Microsoft is mitigating it.

05/14/2026

📢 Heads up to Exchange admins: Microsoft has confirmed there will be no Exchange Server security updates released in May 2026.

This applies to all supported versions, including those in the Extended Security Update (ESU) program.

Full details:

Microsoft announces there are no Exchange Server security updates for May 2026, for customers with Exchange SE, or Exchange 2016, 2019 ESU.

05/08/2026

📢 Microsoft released Exchange Server SE Hotfix Update 6 (HU6) on May 7, 2026.

The key addition: Microsoft Graph support for hybrid features, a meaningful step away from the legacy EWS protocol toward a more modern hybrid integration architecture.

More details here:

Microsoft released Exchange Server SE HU6 (KB5081755) on May 7, 2026, introducing Microsoft Graph support for hybrid features.

04/21/2026

📢 Microsoft Announces Period 2 Exchange 2016/2019 Extended Security Update (ESU) Program.

If your organisation is still running Exchange Server 2016 or 2019, Microsoft has announced one final extension of security coverage.

Period 2 of the ESU program runs from May 1 to October 31, 2026. This is a paid, optional program designed exclusively for organisations actively mid-migration to Exchange Server Subscription Edition (SE) who need a little more time to cross the finish line.

Important to note:

🔹 Period 1 enrolment does not automatically carry over — re-purchase is required
🔹 Any ESU purchase from April 15, 2026 onwards is treated as Period 2
🔹 Covered versions: Exchange 2016 CU23 and Exchange 2019 CU14/CU15
🔹 Updates are privately delivered — not via Windows Update or the Download Center
🔹 Patches are released only when a qualifying security event occurs — no fixed monthly schedule
🔹 There will be no further extensions after October 2026

Speaking of patch cadence, Microsoft has confirmed no Exchange Server security updates for April 2026.

For more details visit our blog here: https://www.messageware.com/microsoft-extends-exchange-server-2016-2019-esu/

Updates on the Exchange Server 2016/2019 ESU program and how it extends security coverage through October 2026.