Microsoft: October 2026 Windows Server updates can destabilise on-premises Exchange; registry workaround issued

Microsoft has confirmed that the October 2026 Windows Server security updates can make on-premises Exchange Server unstable: after roughly a day of load, Outlook on the web sign-in fails, mail queues grow and mailbox databases report as offline until the server is restarted. Microsoft says the problem is not caused by the October Exchange security updates, tells administrators not to uninstall the Windows updates, and offers a registry change as a workaround. As of 19 October, no fixed update has been announced, so anyone running Exchange 2016, 2019 or Subscription Edition on a patched Windows Server should read the details below before the next weekend.

Key points

• The October 2026 cumulative updates for Windows Server add a default limit of 512 stored contexts in the RPC Endpoint Mapper, which busy Exchange servers can hit, according to Microsoft's guidance as reported by BleepingComputer and The Register.
• Symptoms: users can't sign in to Outlook on the web (OWA), mail queues back up, and admins report the error MapiExceptionMdbOffline (ec=1142) even though databases show as mounted.
• Microsoft's workaround is to set the EpmapSavedContextCap registry value under HKLM\SOFTWARE\Microsoft\Rpc to 65536 and restart; it advises against uninstalling the updates.
• Microsoft says the issue is unrelated to the October 2026 Exchange security updates, and that some servers may never be affected.
• The fix is not yet delivered: Microsoft says it is investigating and has not committed to an out-of-band update, The Register reports.

What happened

Reports of Exchange problems started after Patch Tuesday in mid-October. The German Exchange blog Franky's Web reported, in an article updated on 15 October, that about 24 hours after installation, Exchange servers reported database problems with MapiExceptionMdbOffline, users could no longer connect and mail stopped flowing, while the Exchange Admin Center still showed databases as mounted. He first suspected the Exchange security update KB5128895, then corrected his article: the cause was the cumulative October update for Windows Server.

The Exchange Team published its own warning on 16 October, titled "Exchange servers may become unstable after installation of October 2026 Windows updates" (per the dates in search results). It was later expanded. Microsoft's Windows release health page also lists the issue, and BleepingComputer and The Register reported on them on 19 October. The Register's story quotes Microsoft's release health text: "For workloads such as Exchange Server, the default limit of 512 simultaneous Endpoint Lookup calls might not be sufficient under heavy load."

The updates Franky's Web lists are KB5126646 (Windows Server 2025), KB5126655 (2022), KB5126651 (2019) and KB5126868 (2016). We could not open Microsoft's release health pages ourselves, so the KB numbers rest on that article.

Background

The RPC Endpoint Mapper is the Windows component that tells RPC clients which port a service is listening on. Exchange relies on RPC heavily for communication between its own services and with Active Directory. According to Franky's Web, a reader in the comments traced the new behaviour to a limit of 512 stored search contexts in the Endpoint Mapper (RpcEpMap.dll): Exchange keeps creating these contexts, which are released only when the owning process ends. The same article notes that the October updates fix CVE-2026-96300, an uncontrolled-resource-consumption denial-of-service bug in the Endpoint Mapper, and concludes that the new limit is "very likely" that fix. Microsoft has not said so; this link is an administrator's inference.

The timing adds context. BleepingComputer notes that Microsoft announced in July that it would stop providing extended security updates for Exchange 2016 and 2019 in October 2026, after a six-month extension announced in April. Many organisations are therefore still running those versions and patching them at the same time.

How it works

Based on Microsoft's description and the administrators' analysis:

1. The update gives the Endpoint Mapper a cap of 512 simultaneously stored contexts.
2. Exchange creates contexts continuously. On a busy server the cap is reached after roughly 20 to 24 hours (a figure from Franky's Web and a customer on Microsoft's support page who reported the problem "like every 20h").
3. Once the cap is hit, new RPC lookups fail. Exchange then reports databases as offline, OWA fails and queues build.
4. A restart clears the contexts, so the symptoms vanish for about a day. This is why a reboot looks like a cure but isn't.

The workaround, as given by BleepingComputer and the Exchange Team's guidance relayed by Franky's Web, is to run this from an elevated command prompt and restart:

reg add "HKLM\SOFTWARE\Microsoft\Rpc" /v EpmapSavedContextCap /t REG_DWORD /d 65536 /f

The value does not exist by default. Without it, the default of 512 applies, as commenters on Franky's Web point out. Franky's Web notes the Endpoint Mapper reads the value only at startup, so the restart is required, and that in a database availability group servers should be restarted one at a time, checking database copies in between. Microsoft says to monitor afterwards and raise the limit further if the problem returns.

What it means

For administrators: Don't uninstall the Windows updates, per Microsoft; they carry security fixes. Apply the registry change on Exchange servers that have the updates, restart, and watch the queues. Because impact depends on load, small servers may never notice, which can make the first symptoms look random. Franky's Web warns that raising the cap effectively removes the protection the new limit provides against CVE-2026-96300; the same article says Microsoft describes that vulnerability as hard to exploit and calls the workaround temporary, to be removed once a fix ships.

For Microsoft: The Register calls it "bad form" and a "poorly thought-through default". The complaints in the support page comments are about testing: one customer asked Microsoft to release updates "tested and without problems".

What we don't know yet

• Which Windows versions. The Register says Windows Server 2016, 2019, 2022 and 2025 are affected. BleepingComputer's report says 2019 and later. The Register and Franky's Web list all four, and the Exchange Team's own post is the authority.
• A permanent fix. Microsoft says it is investigating and gives no date. The Register says it hasn't committed to an out-of-band update.
• Whether CVE-2026-96300's fix is the cause. This is an inference from administrators, not confirmed by Microsoft.
• Exact thresholds. How many Exchange users or messages per day trigger the issue isn't published.

What to watch next

Watch the Windows release health dashboard and the Exchange Team blog for a status change from "mitigated" to resolved, an out-of-band update, or a revised default. If you apply the workaround, record it so it can be removed once the fix ships.

Sources

• BleepingComputer: Microsoft: October Windows Server updates break Exchange sign-in, mail flow
• The Register: Admin: 'I spent all weekend on my servers' after Microsoft breaks Exchange Server with October updates
• Exchange Team blog: Exchange servers may become unstable after installation of October 2026 Windows updates
• Franky's Web: Exchange Server SE: Problems with the October updates for Windows Server