August 2026 Exchange Security Updates: Pwn2Own Vulnerability Fixed, OWA Light Disabled

On August 11, 2026, Microsoft released security updates (SUs) for Exchange Server, for the fourth consecutive month. The updates fix seven vulnerabilities. None was publicly known in advance, none is currently known to be actively exploited, and Microsoft rates exploitation as “Exploitation Less Likely” for all seven. Still, this is not a routine Patch Tuesday, for three reasons: the update fixes the Exchange vulnerability demonstrated at the Pwn2Own hacking competition, it permanently disables OWA Light after nearly twenty years, and the Exchange team subsequently explained why the monthly cadence will remain the norm for now.

Which Exchange versions the update is available for

The SUs are available for the following versions:

• Exchange Server Subscription Edition (SE) RTM: KB5121573, Build 15.2.2562.46; as a regularly available public update.
• Exchange Server 2019 CU15: KB5121574, Build 15.2.1748.49; only through the Period 2 ESU program.
• Exchange Server 2019 CU14: KB5121575, Build 15.2.1544.44; only through Period 2 ESU.
• Exchange Server 2016 CU23: KB5121576, Build 15.1.2507.72; only through Period 2 ESU.

The situation is the same as in July: Exchange 2016 and 2019 are out of support. Only those enrolled in the Period 2 ESU program receive the SUs from May through October 2026. Everyone else remains unpatched, with fourteen now-known open vulnerabilities, some of them rated highly; migration to Exchange SE can no longer be delayed. Exchange Online is already protected; however, in hybrid environments, the SU must still be installed on all Exchange servers, including dedicated management servers and machines with only the Exchange Management Tools installed.

The known issue with wrapper messages in shared mailboxes in hybrid environments also persists with the August SU; according to Microsoft, the fix is planned for an upcoming update. At least there is reassuring news in the comments on the release announcement: Anyone who configured the documented SettingOverride as a workaround does not need to recreate it after installing the August SU. The update leaves the override untouched, as the Exchange team confirmed there.

The seven vulnerabilities at a glance

Three of these deserve a closer look.

CVE-2026-62913 has the highest score of the month at CVSS 8.8: a remote code execution vulnerability that an authenticated attacker with low privileges can trigger without any user interaction. Any compromised mailbox account is sufficient as a starting point; in an era of phishing and credential stuffing, “authenticated” is not a high bar.

CVE-2026-62911 is the only vulnerability of the month that Microsoft rates as Critical (Elevation of Privilege, CVSS 8.0). There is more history behind it than the plain number suggests: When asked whether the Exchange exploit demonstrated by Orange Tsai at Pwn2Own 2026 had been fixed in the meantime, the Exchange team referred in the comments on the release announcement specifically to this CVE. The competition finding is therefore fixed: another reason not to leave the August SU sitting uninstalled, because Pwn2Own techniques are usually published in detail once embargo periods expire. That has now happened: A proof of concept is public, and the BSI reports around 85 percent vulnerable on-premises servers in Germany. Learn how the attack works technically (MRSProxy without channel binding, NTLM relay) and what lies behind the figures in the detailed article on CVE-2026-62911.

CVE-2026-62914 (Spoofing, CVSS 7.3) is the direct reason for disabling OWA Light, more on that shortly.

The remaining vulnerabilities: CVE-2026-62910 (EoP, 7.2) already requires high privileges, while CVE-2026-62912 (DoS), CVE-2026-62915 (Security Feature Bypass), and CVE-2026-65813 (EoP) have CVSS scores of 6.5. As usual, details are available in the Security Update Guide (filter for “Server Software” for Exchange SE or “ESU” for 2016/2019).

OWA Light: after nearly twenty years, it is over

What the update changes

Installing the August SU permanently disables OWA Light on every server that receives the update (or a later one). Anyone opening the Light interface will instead be taken to the regular Outlook on the web. The disablement is part of the update itself and cannot be reversed with a switch; Microsoft had announced it a few weeks earlier in a separate blog post.

OWA Light dates back to the Exchange 2007 era: an intentionally simple web interface as a fallback for old browsers and slow connections, officially deprecated since August 2024. The rationale for ending it is driven by security: A separate legacy rendering path alongside modern OWA increases complexity and therefore the attack surface; CVE-2026-62914 provides concrete proof of that. Those who read the July article may also remember: the CVE-2026-42897 mitigation from May had already incidentally rendered OWA Light nonfunctional. The interface was therefore already living on borrowed time.

If you cannot patch: disable OWA Light manually

Important for everyone who cannot install the August SU (yet), for example because ESU activation is missing: Microsoft explicitly recommends manually disabling OWA Light in that case to mitigate CVE-2026-62914. This can be done through the OWA mailbox policy and the sign-in page:

Get-OwaMailboxPolicy | Set-OwaMailboxPolicy -OWALightEnabled $false
Get-OwaVirtualDirectory | Set-OwaVirtualDirectory -LogonPageLightSelectionEnabled $false

The first command disables the Light version for all mailboxes covered by the respective policy; the second removes the “Use the light version” selection from the OWA sign-in page. Changes to the virtual OWA directory reliably take effect only after recycling the OWA app pool or a iisreset.

What admins should check now

The shutdown is technically trivial, but not always organizationally: OWA Light was the quiet fallback solution for niche scenarios. You should now review bookmarks and help desk guides that have ?layout=light hardcoded, kiosk and terminal devices with old browsers, and internal instructions for users who used the Light version for accessibility reasons. Modern Outlook on the web works in all current browsers and includes its own accessibility features; but anyone who does not inform affected users in advance will generate tickets.

Why an SU is now released every month and where Exchange SE CU1 stands

Two days after the release, the Exchange team answered the question many admins are asking in a notably candid blog post (“Where is Exchange SE CU1 anyway?”). The short version: Microsoft is using AI tools across the company to find vulnerabilities in its own products. The teams, including Exchange, are currently working through the reported findings: validating, reproducing, fixing, testing for regressions, and shipping them monthly. This has resulted in an Exchange SU every month since May 2026, and Microsoft explicitly states that this increased pace will continue.

The long-awaited CU1 for Exchange SE is delayed for precisely this reason. Originally announced for the first half of 2026 and then moved to the second half, it no longer has a target date at all. Microsoft intends to release CU1 only when there is a month without an urgent security delivery in between; a CU immediately superseded by an SU would create duplicate update work for many organizations. Until then, the monthly security payload continues to flow into the internal CU1 build.

In practice, this means two things. First, waiting for CU1 is not a strategy, neither for migrating to SE nor for installing SUs. Second, a monthly maintenance window for Exchange now needs to be a permanent part of the operations calendar, just as it has long been standard for Windows servers.

Installation and follow-up

The process remains the proven one: First, use the Exchange Health Checker to inventory which servers are on which CU/SU level and whether manual steps are outstanding. Then install the SU (if the CU level is outdated, the Exchange Update Wizard shows the path), restart the server, and verify that all Exchange services started correctly. If services are disabled, the installation was interrupted; in that case, use the documented workaround in the Microsoft support article on the file version error or the SetupAssist script. Finally, run the Health Checker again.

SUs are cumulative: If you skipped the July SU, you can install the August SU directly. And the familiar addition applies to hybrid environments: If the authentication certificate is changed after installing the SU, the Hybrid Configuration Wizard should be run again.

One follow-up task from July remains current: Anyone who still has the CVE-2026-42897 mitigation (M2.1.0) active should now remove it; instructions for doing so properly are in the article on the July SU.

Recommended approach

In short: Install the August SU promptly on all Exchange servers and machines with Management Tools installed: the Pwn2Own vulnerability and the 8.8 RCE are reason enough not to wait until the next Patch Tuesday. If you cannot patch immediately, OWA Light can be manually disabled as an immediate measure against CVE-2026-62914. Before disabling OWA Light, identify and inform affected user groups (old bookmarks, kiosk browsers, accessibility workflows). Then run the Health Checker, complete outstanding follow-up tasks from July, and schedule a monthly Exchange maintenance window, because the cadence will remain.