Exchange updates (SU & CU)
Security updates (SU) and cumulative updates (CU) for Exchange Server in chronological order: closed vulnerabilities, installation pitfalls, and the follow-up work that comes after patch day.
NewExchange Online throttles and blocks outdated Exchange 2016 and 2019 servers starting in September 2026: How transport enforcement works
Starting in the second week of September 2026, Exchange Online requires hybrid servers to have at least the October 2025 SU; otherwise, mail flow is throttled and later blocked. Background on transport enforcement since 2023, escalation stages with SMTP codes, the report in the Admin Center, the 90-day pause via PowerShell, and why the next increase will only allow ESU customers and Exchange SE.
August 2026 Exchange Security Updates: Pwn2Own Vulnerability Fixed, OWA Light Disabled
The August SU fixes seven vulnerabilities, including the Exchange exploit demonstrated at Pwn2Own 2026, and permanently disables OWA Light. Microsoft also explains why Exchange SUs are now released monthly and why Exchange SE CU1 is still delayed.
Properly follow up on the July 2026 Exchange security updates
Two cleanup tasks are needed after installation: safely remove the old CVE-2026-42897 mitigation and review overprivileged legacy groups in Active Directory.
