Final Exchange 2016/2019 patch ships as Windows update destabilizes servers

On 13 October 2026 Microsoft released the last security update for Exchange Server 2016 and 2019, fixing seven CVEs including critical CVE-2026-70571 (CVSS 8.1). Three days later the Exchange team warned that October Windows Server patches (KB5126646, KB5126655, KB5126651, KB5126868) cause OWA failures, growing mail queues and DAG quorum loss. Microsoft advises keeping the update and setting the EpmapSavedContextCap registry value to 65536, then rebooting.

• CVE-2026-70571 is a stack buffer overflow rated CVSS 8.1, marked exploitation more likely
• From November 2026 updates ship for Exchange SE only
• Symptoms include MapiExceptionMdbOffline, event ID 1006 and stalled mail queues
• Fix: set EpmapSavedContextCap=65536 in the registry and reboot