KERNELHAWK Request an assessment
KernelHawk field briefing / Email security

October Exchange updates: check the build and the Windows advisory

Exchange had more than one update milestone this month. A useful patch record identifies the installed build, the Windows update state, and whether mail still works after the change.

Published 3 minute readUpdates: October 2 and 13 · Windows advisory: October 16, 2026

Two update milestones in October

Microsoft published September V2 Exchange security updates on October 2, adding a fix for CVE-2026-96940. Its announcement said it was not aware of active exploitation at publication. A record saying “September updates installed” therefore needs the release revision.

There are later October 13 builds in Microsoft's official release table. For example, Exchange Server SE RTM moved from September V2 build 15.2.2562.53 to October build 15.2.2562.56. Check the current row for your own branch when planning the update.

Microsoft says Exchange Online was already protected from the issues in the October 2 notice, while customer-managed Exchange servers and management tools still require attention. Older Exchange 2016 and 2019 installations also need a support check: access to these updates depends on the relevant Extended Security Update program.

Read the Windows interoperability advisory too

In its October 16 advisory, updated October 20, Microsoft describes mail delays, Outlook on the web failures, and database availability problems after certain Windows Server updates. It attributes this issue to the Windows updates rather than the Exchange security update.

Microsoft recommends keeping the security updates and applying its documented workaround, with a reboot and monitoring. Have the Exchange administrator follow the current advisory for the relevant Windows version and involve Microsoft support if symptoms persist.

KernelHawk's recommendation: close the change with evidence

Ask whoever manages email for a short record covering each Exchange server and any management-only machines:

  • The installed Exchange build and Windows update identifiers.
  • The applicable vendor guidance and any required manual actions.
  • The restart time and results for mail flow, web access, and database health.
  • An owner for follow-up if queues grow or users report failures.

A working sign-in immediately after a restart is only one observation. Include checks later in normal operation, and keep the mailbox service's recovery procedure available during the change window.

Sources and date

  1. Microsoft Exchange Team, September V2 security updates, October 2, 2026.
  2. Microsoft Exchange Server build numbers and release dates, including the October 13, 2026 releases.
  3. Microsoft Exchange Team, Windows update interoperability advisory, October 16, updated October 20, 2026.

Sources checked October 24, 2026. Confirm current vendor instructions before making changes.