Skip to content
audiotale.net
Sign in
NewsNews

Exchange Server 2016 and 2019 'permanently vulnerable' as KB5133453 patches Exchange SE only

Microsoft's November 2026 Exchange update (SU12, KB5133453) fixes nine CVEs including critical CVE-2026-118207 in Exchange SE, and tells 2016 and 2019 users to upgrade immediately.

audiotale.net team

· 6 min read

Written by AI from the sources linked below. How we use AI

On this page
  1. Key points
  2. What to do
  3. What happened
  4. Background
  5. The numbers
  6. What it means
  7. What we don't know yet
  8. What to watch next
  9. Sources

Microsoft has told customers still running Exchange Server 2016 or 2019 to "consider them permanently vulnerable" and to upgrade immediately. The warning appears in the Exchange team's post for the November 2026 security update, which was released on 10 November 2026 for Exchange Server Subscription Edition (SE) only. Anyone who runs those older versions on premises is now outside every route to a security fix, while Exchange SE has just received a patch for nine vulnerabilities, one of them rated critical.

Key points

  • Microsoft's Exchange team says Exchange Server 2016 and 2019 "are no longer tested for vulnerabilities and there are no updates released", and that they should be considered permanently vulnerable.
  • The November 2026 Exchange SE security update (SU12, KB5133453, build 15.2.2562.57, released 10 November 2026) fixes nine CVEs, including the critical remote code execution flaw CVE-2026-118207 (CVSS 8.8).
  • The final Exchange 2016 and 2019 security updates shipped on 13 October 2026, according to The Register; Microsoft's post says the Period 2 ESU program has ended.
  • The Register reports that November's security fixes arrived for Exchange SE alone; there is no patch route for 2016 or 2019.
  • Microsoft says the November Windows Server updates fix the Exchange instability that followed the October 2026 Windows updates.

What to do

  • Find out what you run. Microsoft points to the Exchange Server Health Checker script, which reports whether any of your servers are behind on cumulative updates, security updates or manual actions.
  • If you run Exchange SE: install the November 2026 SU (KB5133453, SU12). Security updates are cumulative, so if you run a CU that the SU supports you only need the latest one. Microsoft recommends installing it on all Exchange servers and on every server or workstation that runs the Exchange Management Tools, including management-only machines in a hybrid setup with Exchange Online.
  • After installing, reboot and check that all Exchange services have started. If some are disabled, Microsoft says that points to an interrupted installation and refers to its workaround article. If setup fails, it points to the SetupAssist script.
  • If you changed the auth certificate after installing an SU in a hybrid deployment, re-run the Hybrid Configuration Wizard.
  • If you run Exchange 2016 or 2019: there will be no patch to apply. Microsoft's instruction is to upgrade your organization immediately. The practical options are Exchange SE on premises or moving mailboxes to Exchange Online.
  • If Exchange became unstable after the October 2026 Windows updates: install the November 2026 Windows Server updates. If you created the registry key to raise the new RPC default limit as a workaround, you can leave it in place, but it is no longer required after the November updates. The order of the Exchange and Windows updates does not matter, Microsoft says.

What happened

On 10 November 2026 the Exchange team released the November security update for Exchange SE RTM. Microsoft's KB5133453 lists nine CVEs fixed: CVE-2026-118149 (remote code execution), CVE-2026-118150, -118151, -118154 and -118157 (elevation of privilege), CVE-2026-118152 and -118208 (spoofing), CVE-2026-118153 (denial of service) and CVE-2026-118207 (remote code execution). The update replaces the October 2026 update, KB5128895. It also fixes a separate issue where Microsoft Graph showed incorrect free/busy availability in an Exchange SE hybrid setup.

Alongside the list, the team's release post carried the blunt message for older servers. In its FAQ it answers the obvious question, whether the absence of any 2016 or 2019 entries means those versions are safe, with a no: they are out of support, and "no longer tested for vulnerabilities", so there is nothing to report.

The Register reported the warning on 12 November, noting that it appears in the release documentation for the SE update.

Background

Support for Exchange Server 2016 and 2019 officially ended on 14 October 2025. Microsoft announced a paid Extended Security Updates program in July 2025. According to The Register, the company said that period would not go past April 2026, then offered another six months of paid security updates when it became clear customers were still on the old versions. The Register reports that the final 2016 and 2019 security updates were released on 13 October 2026. Microsoft's November post confirms that the Period 2 ESU program has ended.

The October 2026 Windows updates added a complication. Microsoft's Exchange team documented that Exchange servers might become unstable after installing the October Windows Server updates, and the November post says installing November's Windows updates resolves it. Eightwone, an Exchange specialist blog, describes the cause as an issue with the RPC endpoint mapper and the new default RPC limit.

We covered an earlier wave of patch-day fallout in our November 2026 Patch Tuesday outlook and the SQL Server linked-server issue after October's Windows updates.

The numbers

The nine Exchange SE vulnerabilities in the November update, with the severity ratings and CVSS v3.1 base scores listed by the Exchange specialist Michel de Rooij on Eightwone, are summarised below.

Exchange SE November 2026 update: CVSS v3.1 base score per CVECVSS base score
Exchange SE November 2026 update: CVSS v3.1 base score per CVE (CVSS base score)
CVSS base score
CVE-2026-118207 (RCE, Critical)8.8
CVE-2026-118149 (RCE)8.8
CVE-2026-118150 (EoP)8.8
CVE-2026-118154 (EoP)8.8
CVE-2026-118153 (DoS)7.5
CVE-2026-118151 (EoP)7.2
CVE-2026-118157 (EoP)7.2
CVE-2026-118208 (Spoofing)7.1
CVE-2026-118152 (Spoofing)6.5

Source: Eightwone (Michel de Rooij), listing Microsoft's ratings

Only CVE-2026-118207 is rated Critical by Microsoft; the other eight are rated Important, even though three of them also score 8.8 by CVSS. Microsoft's severity rating and the CVSS base score are separate measures.

What it means

For organizations still on 2016 or 2019, the message is that patching has stopped being a thing you can do. The last updates are installed, no new ones will come, and Microsoft will no longer test those versions for vulnerabilities. That includes flaws that Microsoft fixes in Exchange SE this month: the company does not say whether CVE-2026-118207 and the other eight also affect the older versions, because it no longer checks.

For defenders, CrowdStrike's Patch Tuesday analysis describes CVE-2026-118207 as stemming from use of an incorrectly resolved name or reference, allowing an authenticated attacker with low-level access to send a crafted request and execute code on the server, without user interaction. CrowdStrike argues the authentication requirement only modestly lowers the bar, because any compromised mailbox credential or service account would satisfy it, and says Exchange servers have historically drawn sustained attention from nation-state actors and ransomware operators. That is CrowdStrike's assessment, not Microsoft's.

For hybrid customers, Microsoft notes that Exchange Online is already protected, but the SU must still be installed on Exchange servers in the environment, even when those servers are used only for management.

For budget holders, the extra six months of paid updates is over. The choice now is between Exchange SE, Exchange Online, or another mail platform; any plan that depends on keeping 2016 or 2019 running safely needs to change.

What we don't know yet

  • Whether the November vulnerabilities are present in Exchange 2016 and 2019. Microsoft says it no longer tests them.
  • Whether any of the nine flaws are being exploited. We found no report of exploitation of CVE-2026-118207.
  • Whether Microsoft will make any further exception for older versions. Its current wording gives no sign of one.

What to watch next

  • December 2026 Patch Tuesday: the next Exchange SE update, and whether any advisory mentions the older versions.
  • Exploitation reports for Exchange SE vulnerabilities, which would raise the urgency of patching quickly.
  • Further updates to the Exchange team's blog post, which Microsoft says may receive later changes.

Sources

SaveStart the discussion

Written by

audiotale.net team

The official account of the people who run audiotale.net: announcements, conversation starters and the newsroom's drafts. Posts written with AI say so. Every other account here is a real person.

Read next