Microsoft has officially acknowledged that the Windows Server security updates rolled out on October 13, 2026, may inadvertently disrupt Exchange Server email services. This disruption can manifest as blocked webmail access and undelivered messages, affecting a subset of on-premises systems running Exchange Server 2016, Exchange Server 2019, and the Exchange Server Subscription Edition.
In response to these complications, Microsoft has released a workaround and strongly advises administrators against uninstalling the Windows updates. The root of the issue lies within changes made to Windows Server itself, rather than the separate Exchange Server security updates issued in October. Notably, servers can experience these problems even if the latest Exchange patches are not installed, emphasizing that the underlying operating system update is pivotal in diagnosing these outages.
Affected Updates and Exchange Server Symptoms
Microsoft has pinpointed four specific Windows updates that are associated with these failures:
- KB5126646 for Windows Server 2025
- KB5126655 for Windows Server 2022
- KB5126651 for Windows Server 2019
- KB5126868 for Windows Server 2016
The impact of these updates can vary based on server workload, meaning that some systems may remain unaffected. However, users might find themselves unable to log into Outlook on the web, while messages sent through Outlook could become stuck in the Outbox. Administrators may observe an increase in mail queues, failed mailbox access during replication, or issues with Database Availability Group members failing to reach quorum. A temporary service restoration may be achieved by restarting the affected server.
One critical error to monitor is MapiExceptionMdbOffline: Unable to make connection to the server. (hr=0x80004005, ec=1142). Additionally, affected systems may log Event ID 1006 in the Application log, which can serve as a valuable indicator when assessing whether an outage aligns with Microsoft’s findings.
According to Microsoft’s Windows release health notice, the October updates introduced a default limit of 512 simultaneous Endpoint Lookup calls. This limit is designed to manage memory usage by Endpoint Mapper, a Windows component integral to remote procedure call communications. In scenarios where Exchange workloads are heavy, this default allowance may be exceeded.
To address this, increasing the limit allows Endpoint Mapper to utilize more memory for handling these calls. Microsoft currently categorizes the issue as mitigated, rather than fully resolved, and continues its investigation. For organizations affected by this disruption, an additional mitigation option is available through Microsoft Support.
Microsoft’s Registry Workaround
In its advisory, Microsoft’s Exchange Team provides a registry workaround for administrators. They are instructed to open an elevated Command Prompt on the Exchange server and execute the command: reg add "HKLMSOFTWAREMicrosoftRpc" /v EpmapSavedContextCap /t REG_DWORD /d 65536 /f. Following this, a server restart is necessary.
Post-reboot, administrators should vigilantly monitor their environment for any recurring failures. Microsoft suggests that if issues persist, the limit may need to be raised further, although specific additional values are not provided in the advisory. The company reports that this approach has successfully resolved the issue in cases it has addressed.
Maintaining the installation of security updates is crucial. Recent coverage from Cybersecurity News highlighted Microsoft’s reissued Exchange Server security update, underscoring the ongoing necessity for supported patches.
This disruption coincides with the impending end of the final paid update period for Exchange 2016 and 2019. As previously reported, Microsoft has indicated that October 2026 marks the last scheduled Extended Security Update (ESU) release for these versions, with future updates being limited to the Subscription Edition.
An EDR alert reveals an attack. But can it tell the full story? Discover how to reconstruct the attack timeline.