Loading story…
Microsoft released KB5121611, the September security update for Exchange Server 2016 CU23, addressing seven vulnerabilities: CVE-2026-69355, CVE-2026-69356, CVE-2026-69361, CVE-2026-69375, CVE-2026-69378, CVE-2026-69382, and CVE-2026-69641. A security advisory from Gambia’s national CSIRT characterized the Exchange Server issue as a pre-authentication remote-code-execution risk.
The update also fixes a hybrid-deployment issue that caused wrapper messages to appear in shared mailboxes following the June 2026 security update. Microsoft cautioned that published calendar .ics files may return HTTP 500 errors after installation; Exchange Server 2016 and 2019 are out of support, with updates available only to organizations in the Period 2 Extended Security Update program through October 2026, and organizations should migrate to Exchange Server Subscription Edition.
See real exploitation activity before you spend the cycle.
1 event from the most recent confirmed update back to the earliest known activity.
Microsoft released Exchange Server 2016 Cumulative Update 23 Security Update 25 (KB5121611), addressing seven Exchange Server vulnerabilities: CVE-2026-69355, CVE-2026-69356, CVE-2026-69361, CVE-2026-69375, CVE-2026-69378, CVE-2026-69382, and CVE-2026-69641. The update also fixed a hybrid-environment shared-mailbox wrapper-message issue introduced after the June 2026 Security Update.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
2 references tracked. Mallory keeps watching after this page renders.
gmcsirt.gm
Open sourcesupport.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft published security advisories for several **Microsoft Exchange Server remote code execution** vulnerabilities, including `CVE-2021-26427`, `CVE-2022-21969`, `CVE-2022-23277`, and `CVE-2023-36778`. The flaws affect on-premises Exchange Server deployments and were addressed through Microsoft's Security Update Guide, indicating a recurring pattern of high-impact code-execution risk in a core enterprise messaging platform. The advisories show Microsoft issuing fixes over multiple release cycles for distinct Exchange Server RCE bugs rather than a single isolated defect. For defenders, the immediate implication is to verify that all supported Exchange Server instances have the relevant cumulative and security updates applied, because unpatched mail servers remain a high-value target due to their internet exposure, privileged position in enterprise environments, and history of exploitation by threat actors.
Jul 12, 2026
Microsoft’s Security Update Guide lists several vulnerabilities spanning Exchange Server and Windows components, including `CVE-2022-41092`, `CVE-2022-41120`, `CVE-2024-49009`, `CVE-2025-21206`, and `CVE-2025-62570`. The references point to official MSRC advisory pages, indicating these issues were tracked through Microsoft’s vulnerability disclosure and patching process even though the provided entries do not include technical synopses. The set includes older Exchange-related flaws alongside newer Microsoft-tracked CVEs, suggesting continued attention to enterprise software exposure across on-premises messaging and Windows ecosystems. Organizations relying on Microsoft products would need to review the corresponding MSRC pages, determine affected versions, and apply available security updates or mitigations to reduce the risk of exploitation tied to these identifiers.
Jul 12, 2026
Microsoft has disclosed multiple **elevation of privilege** vulnerabilities affecting **Microsoft Exchange Server**, including `CVE-2021-34470`, `CVE-2021-41348`, `CVE-2022-41123`, and `CVE-2025-64666`, indicating a recurring security issue in the on-premises mail platform across several release cycles. The advisories show Exchange continued to receive fixes for privilege-escalation weaknesses over multiple years, with Microsoft publishing separate Security Update Guide entries as new flaws were identified. Among the listed issues, Microsoft provided the most detail for `CVE-2021-34470`, rating it **Important** with a **CVSS 3.0 score of 8.0** and describing it as requiring access from a logically adjacent network. Microsoft said the flaw required a **schema change** and was fixed for **Exchange Server 2019** and **Exchange Server 2016** in cumulative updates released on June 29, 2021; at initial publication, the company said it was **not publicly disclosed**, **not exploited**, and **less likely to be exploited**. A separate Microsoft advisory in the same reference set, `CVE-2026-26128`, affects the **Windows SMB Server** rather than Exchange and also involves elevation of privilege.
Jun 29, 2026