Why This Matters for SMB Exchange Admins
If your organization still runs on-premises Exchange Server, the September 2026 Exchange Server security updates are worth prioritizing. Microsoft has released a set of security updates for four supported Exchange Server builds, addressing multiple vulnerabilities. For SMBs running any on-premises Exchange infrastructure — including hybrid deployments that connect on-premises Exchange to Microsoft 365 — applying these updates promptly, and understanding which builds are still eligible for support, is part of basic operational hygiene.
This article summarizes what Microsoft’s official KB articles say about the September 2026 updates: which Exchange Server versions are covered, which vulnerabilities are addressed, known issues to expect, and what the end-of-support timeline means for organizations that haven’t yet moved to Exchange Server Subscription Edition (SE).
Which Exchange Server Versions Are Covered
Microsoft published four separate KB articles for the September 8, 2026 security update cycle, each targeting a specific Exchange Server build:
- Exchange Server Subscription Edition (SE) RTM — KB5121608
- Exchange Server 2019 Cumulative Update 15 (CU15) — KB5121609
- Exchange Server 2019 Cumulative Update 14 (CU14) — KB5121610
- Exchange Server 2016 Cumulative Update 23 (CU23) — KB5121611
Each update is version-specific. Installing the wrong package for your build isn’t a documented option, so administrators should confirm their current cumulative update level before downloading and applying any of these packages.
What Vulnerabilities Do These Updates Address
According to the official Microsoft KB articles, the September 2026 updates resolve vulnerabilities in Exchange Server tracked under the following CVE identifiers:
- CVE-2026-55007
- CVE-2026-69355
- CVE-2026-69356
- CVE-2026-69361
- CVE-2026-69375
- CVE-2026-69378
- CVE-2026-69382
- CVE-2026-69641
The Subscription Edition RTM, Exchange 2019 CU14, and Exchange 2019 CU15 updates each address all eight of these CVEs. The Exchange 2016 CU23 update addresses seven of the eight — it does not list CVE-2026-55007 among the vulnerabilities it resolves. This is a documented difference between the KB articles rather than an assumption; if your organization runs Exchange Server 2016, it’s worth confirming this scope directly against the KB before assuming parity with the other builds.
The Microsoft KB articles do not include detailed descriptions of vulnerability severity or attack vectors in the source content reviewed for this article, so this summary is limited to the CVE identifiers and affected products as published.
Known Issues to Expect After Installing
Microsoft’s KB articles list known issues that may surface after the update is applied. These are documented issues, not speculation:
- Published calendar (.ics) returns HTTP 500 for calendar applications. This known issue is listed for all four updates (Subscription Edition RTM, Exchange 2019 CU14, Exchange 2019 CU15, and Exchange 2016 CU23).
- Availability (free/busy) fails for delegated mailboxes in Exchange hybrid deployments using Graph API only. This known issue is listed specifically for the Subscription Edition RTM update.
If your organization relies on hybrid free/busy lookups through Microsoft Graph for delegated mailboxes, and you’re running Subscription Edition, this is worth testing in a non-production environment before wide deployment.
Issues Resolved by This Update Cycle
The same KB articles also document issues that this update cycle fixes:
- Wrapper messages appear in shared mailbox in hybrid environments after installing the June 2026 Security Update. This fix applies across all four covered builds.
- Hybrid free/busy through Microsoft Graph incorrectly shifts busy times by requester timezone. This fix is documented specifically for the Subscription Edition RTM update.
If your organization experienced either of these symptoms after the June 2026 security update, the September 2026 update is the documented fix path according to Microsoft.
Deployment Steps Microsoft Documents
Each KB article points to the same core deployment process:
- Download the correct package for your Exchange Server build from the Microsoft Download Center. The packages are version-specific (for example, the Subscription Edition RTM package is distinct from the Exchange 2019 CU14 or CU15 packages).
- Install the update following the guidance referenced in Microsoft’s Exchange Server security update and hotfix packaging documentation.
- Run the Exchange Server Health Checker after installation. Microsoft’s KB articles specifically recommend this step to verify that the installation was successful and to identify whether any additional actions are required.
- Review the known issues list for your specific build before and after deployment, so you can distinguish an update-related known issue from an unrelated problem in your environment.
Each of the four September 2026 updates also replaces a specific August 11, 2026 update (for example, KB5121608 replaces KB5121573 for Subscription Edition RTM). If you’re on the August update, the September release is the documented successor for your build.
End-of-Support Status: Exchange 2016 and 2019
This is one of the most important points for SMB administrators still running Exchange Server 2016 or 2019. Microsoft’s KB articles state plainly that Exchange Server 2016 and Exchange Server 2019 have reached end of support. This affects how long these builds continue receiving security updates:
- Organizations enrolled in the Period 2 Extended Security Update (ESU) program are eligible to receive released security updates only until the end of October 2026.
- Organizations that are not enrolled in the ESU program are directed by Microsoft to migrate to Exchange Server Subscription Edition (SE) to continue receiving the latest security updates.
- Organizations that have already purchased ESU and need help accessing the latest security updates are directed to contact Microsoft via the email address listed in the KB articles.
This end-of-support detail applies to the Exchange 2016 CU23, Exchange 2019 CU14, and Exchange 2019 CU15 updates. It is not mentioned in the same way in the Subscription Edition RTM KB article, which is consistent with SE being the actively supported, non-end-of-life edition.
Risks of Delaying This Update
Microsoft’s KB articles don’t quantify risk levels or provide a business-impact assessment, so this section reflects practical governance guidance rather than a documented Microsoft statement. Based on what the KB articles do confirm — that these are security updates addressing multiple CVEs, and that two major on-premises versions have already reached end of support — SMB administrators should weigh the following practical considerations:
- Unpatched vulnerabilities remain unpatched. Delaying the update leaves the CVEs listed in the relevant KB article unaddressed on your Exchange servers.
- The ESU clock is running out for Exchange 2016 and 2019. Per the KB articles, Period 2 ESU coverage ends at the end of October 2026. Organizations not enrolled in ESU and not yet planning a move to Subscription Edition should treat this as a near-term deadline rather than a distant one.
- Hybrid deployments may be affected by both fixes and known issues. If your organization uses Exchange hybrid configurations with Microsoft 365, the free/busy and calendar-related items documented in these KBs are directly relevant to mailbox and scheduling functionality that end users notice quickly.
As a practical recommendation, SMB admins should treat security update deployment as a routine, scheduled activity — testing in a non-production environment where feasible, then applying to production promptly — rather than deferring until an incident forces the issue.
Conclusion
The September 2026 Exchange Server security updates cover four builds — Subscription Edition RTM, Exchange 2019 CU14, Exchange 2019 CU15, and Exchange 2016 CU23 — and address up to eight documented CVEs, with Exchange 2016 CU23 covering seven of them. Each update comes with its own known issues and resolved issues, and Microsoft’s Health Checker tool remains the documented way to confirm a successful install.
The bigger strategic point for many SMBs is the end-of-support status of Exchange Server 2016 and 2019. With ESU coverage under Period 2 ending at the end of October 2026, organizations still on these versions have a limited runway before they need either active ESU enrollment or a migration plan to Exchange Server Subscription Edition. Reviewing your current build, confirming ESU status if applicable, and scheduling this update alongside a broader migration conversation is a reasonable next step for any admin managing on-premises Exchange today.
This article is a draft based on the supplied Microsoft KB articles and requires human review before publication.