Microsoft has confirmed that its October 2026 Windows security updates can stop on-premises Exchange servers from working properly. After the update, users may not be able to sign in to Outlook on the web (OWA), outgoing messages can sit in the Outbox, email queues can grow, and Exchange can have trouble accessing mailboxes during mailbox replication. Microsoft's release health entry describes the issue as reported on Exchange Server 2016, Exchange Server 2019 and Exchange Server Subscription Edition (SE), and lists Windows Server 2016, 2019, 2022 and 2025 as affected platforms. This is a reliability regression, not a security vulnerability, and no exploitation is involved.

The Windows release health dashboard lists the problem as a known issue for Windows Server 2025. The originating update there is KB5126646 (OS Build 26100.33650), released on 2026-10-13. Microsoft opened the entry at 16:19 PT on 2026-10-16, last updated it at 21:26 PT that day, and marks it Mitigated. The entry names Windows Server 2025, 2022, 2019 and 2016 as affected platforms and lists no affected Windows client versions. BleepingComputer's report describes the affected hosts as Exchange servers running Windows Server 2019 and later; the release health entry also includes Windows Server 2016.

What breaks, and how it shows up

According to the release health entry, administrators may see the following on affected Exchange servers:

  • Users cannot sign in to Outlook on the web (OWA).
  • Email messages sent from Outlook remain in the Outbox and are not delivered.
  • Email queues keep growing.
  • Exchange has trouble accessing mailboxes during mailbox replication.
  • In some configurations, OWA fails with the error MapiExceptionMdbOffline: Unable to make connection to the server. (hr=0x80004005, ec=1142), with Event ID 1006 logged in the application log.

BleepingComputer reported Microsoft's statement that any version of Exchange running on an affected version of Windows could be impacted. How badly a server is hit depends on its load, and Microsoft says some servers might never see a problem. Because the trigger depends on load, a server that looks healthy on a quiet day could still run into trouble during peak business hours.

The cause: a new cap on Endpoint Mapper lookups

Exchange relies on Remote Procedure Call (RPC). RPC clients find services through the Endpoint Mapper, which resolves which endpoint a given service is listening on. Microsoft's explanation in the release health entry is short: "The October 2026 update introduced a default limit on the amount of memory used by Endpoint Mapper when handling Endpoint Lookup calls."

That default allows 512 simultaneous Endpoint Lookup calls. Microsoft says that for workloads such as Exchange Server, this may not be enough under heavy load. When a busy Exchange server exceeds the ceiling, the result is the OWA, Outbox, queue and replication symptoms above. Microsoft has not given a further reason for adding the limit. Its own wording describes it as a control on how much memory the Endpoint Mapper uses.

Microsoft also made clear that the October Exchange patches are not the cause. According to BleepingComputer, Microsoft said the issues are not related to the October 2026 Exchange Server security updates. The release health entry adds that installing the October 2026 Exchange Server security updates is not required for the issues to occur. Administrators who held back the Exchange updates but installed the Windows update can still be affected.

Microsoft's workaround

The release health entry points administrators to a registry change described in an Exchange Team blog post titled "Exchange servers may become unstable after installation of October 2026 Windows updates." Microsoft says the registry setting raises the maximum number of simultaneous Endpoint Lookup calls, which also raises the amount of memory the Endpoint Mapper can use. According to BleepingComputer, the temporary workaround sets the RPC registry value EpmapSavedContextCap. Administrators then reboot the server, monitor it, and raise the limit further if the problem comes back. Microsoft's release health entry adds that an additional mitigation is available through Microsoft Support for business.

According to BleepingComputer, Microsoft advises against uninstalling the October Windows updates. Removing them would also remove that month's Windows security fixes from the affected servers. The registry change lets those fixes stay in place while relieving the bottleneck.

Bad timing for Exchange 2016 and 2019

The regression comes during the final month of extended security update coverage for Exchange 2016 and 2019. BleepingComputer notes that Microsoft will stop shipping ESUs for both versions in October 2026, after a six-month extension it announced in April 2026. Organizations still running those versions now have to deal with a Windows-level regression while also planning their move to Exchange SE or another platform. The release health entry lists Exchange SE as affected too, so migrating does not avoid this issue.

What It Means for Defenders

  • Keep the October Windows updates installed. Microsoft says not to roll them back. If you have not yet deployed KB5126646 (Windows Server 2025) or the October 2026 Windows security updates for other affected Windows Server versions to Exchange hosts, plan the registry mitigation into the same maintenance window instead of delaying the security fixes.
  • Check for the signature. Search Exchange server application logs for Event ID 1006 together with MapiExceptionMdbOffline ... ec=1142. Also check queue lengths, Outbox backlogs, OWA sign-in failures and mailbox replication health, especially during peak load.
  • Apply the documented mitigation where you see symptoms. Follow the Exchange Team blog guidance to raise EpmapSavedContextCap, then reboot and keep monitoring. Use the value Microsoft recommends rather than one copied from a forum. If symptoms continue, contact Microsoft Support for business to get the additional mitigation.
  • Don't assume quiet servers are fine. Microsoft says impact depends on load. A server that is healthy today may struggle during month-end processing, migrations or large mail bursts. Consider applying the mitigation before peak periods, after testing it on a non-production or lower-load node.
  • Do not hold back the Exchange security updates because of this issue. Microsoft says the problem is unrelated to the October 2026 Exchange security updates and can occur without them. Stay current on both Windows and Exchange patches.
  • Plan for the end of Exchange 2016/2019 ESU coverage. ESU coverage for these versions ends this month. Make sure your migration timeline covers servers that will stop receiving new security updates.
  • Watch the release health entry. The issue is marked Mitigated, not Resolved, and Microsoft says it is still investigating. A permanent fix in a later Windows update may change the guidance, so track the entry and the Exchange Team blog.

Sources