Microsoft’s October Exchange patches: here’s who can install them

Microsoft pushed new Security Updates for on‑premises Exchange in October 2026, and they’re not one‑size‑fits‑all. The patches land for specific builds—and some are gated behind Microsoft’s Extended Security Updates program.

Microsoft lists three product lines in scope: Exchange Server Subscription Edition, Exchange Server 2019, and Exchange Server 2016. That narrows the patch audience to on‑premises customers still running these supported branches.

For Exchange Server 2019, Microsoft names two eligible cumulative updates: CU14 and CU15. Organizations on other 2019 builds aren’t included in this release window.

Access to the Exchange 2019 fixes isn’t automatic. Microsoft says you must be enrolled in its Period 2 Extended Security Updates (ESU) program to obtain the downloads for CU14 and CU15.

Exchange Server 2016 remains covered—but again, only a specific build. Microsoft’s post calls out CU23 as the target for the October 2026 updates.

As with Exchange 2019, Exchange 2016 customers need to be in Microsoft’s Period 2 ESU program to access the CU23 packages. Without ESU, the downloads aren’t available.

The Subscription Edition of Exchange is also in the mix. Microsoft lists Exchange Server Subscription Edition RTM as receiving October 2026 Security Updates.

Microsoft attributes the fixes to vulnerabilities “responsibly reported to Microsoft by security partners” and those found through Microsoft’s own processes. That implies a blend of external reporting and internal discovery behind the patch set.

The announcement comes via the Exchange Team Blog on Microsoft Tech Community, the company’s usual venue for Exchange update details and deployment guidance.

These are Security Updates, not new feature releases, and they’re meant to remediate vulnerabilities in the named builds. Microsoft’s post emphasizes the vulnerability focus in its description of the release.

Microsoft’s language points to coordinated disclosure. By highlighting “responsibly reported” issues from partners, the company signals that some bugs were identified before widespread exploitation.

The ESU requirement is explicit for Exchange Server 2019 CU14/CU15 and Exchange Server 2016 CU23. Microsoft frames ESU enrollment as the gate to access the October downloads for those products.

Exchange Server Subscription Edition RTM is the outlier that doesn’t carry an ESU enrollment note in Microsoft’s post, indicating its updates are available under the subscription’s normal servicing.

For teams juggling multiple Exchange generations, the version specificity matters. CU14 and CU15 on 2019 are in; earlier CUs are not named in Microsoft’s October list.

The Exchange 2016 scope is equally narrow: CU23 only. Microsoft does not reference other 2016 CUs in the October post.

Microsoft’s post ties the October updates to vulnerabilities, not to operational tuning. That steers administrators toward security‑motivated maintenance windows rather than feature testing cycles.

Organizations relying on on‑prem Exchange for mail routing, compliance journaling, or legacy app integrations will want to check the exact build numbers before planning their patch order.

Microsoft’s ESU mention also signals a licensing checkpoint for 2016 and 2019. Without Period 2 ESU, qualifying servers can’t pull the October packages even if they’re on the right CU.

The announcement does not enumerate public CVE IDs or scores in the portion of the post we reviewed, but it states that vulnerabilities were identified through Microsoft and partner efforts.

The coverage across three product lines suggests Microsoft continues to maintain security servicing for on‑prem Exchange users who stay on current builds or carry ESU where required.

While this release focuses on Exchange servers, email defenses are rarely one layer. We’ve covered how gateway flaws can become high‑impact entry points in our report on the Cisco email gateway zero‑day, and how attackers weaponize cloud accounts behind massive phishing runs in our piece on a phishing takedown coalition.

For security teams, Microsoft’s October note underscores the basics: know your exact Exchange edition and CU, confirm ESU status where needed, and slot the SU into a change window that preserves mail flow.

If your stack spans multiple defenses, cross‑check that your incident response playbooks reflect the current Exchange versions. Our Proofpoint intent‑centric defense coverage shows how email, inbox, and browser layers are converging—even as server patches remain foundational.

For a broader view on operational hygiene, our security category hub collects recent server‑side and gateway risks that can intersect with Exchange patch timelines.

Microsoft’s October release is brief, but its version and ESU specifics carry real planning consequences for anyone still hosting Exchange on‑premises.

What happened

Microsoft published October 2026 Security Updates for Exchange Server. The company’s Exchange Team Blog lists Exchange Server Subscription Edition, Exchange Server 2019, and Exchange Server 2016 as in scope.

The supported Exchange 2019 builds for this release are CU14 and CU15. Microsoft ties access to Period 2 Extended Security Updates (ESU) enrollment for these downloads.

Exchange Server 2016 CU23 is also covered. Like 2019, Microsoft requires Period 2 ESU enrollment to obtain the October 2026 packages.

Exchange Server Subscription Edition RTM rounds out the set. Microsoft includes it in the October Security Updates without an ESU requirement in its listing.

Microsoft says the updates address vulnerabilities reported by security partners and uncovered through Microsoft’s own efforts, indicating a mix of external and internal discovery.

The background

Microsoft continues to ship Security Updates (SUs) for on‑premises Exchange versions still within its servicing and ESU frameworks. The October 2026 post is part of that cadence.

The Exchange 2019 coverage is limited to CU14 and CU15. Microsoft’s listing does not mention other 2019 CUs for this cycle.

Exchange 2016 coverage is limited to CU23. Microsoft’s post does not name any earlier 2016 CUs as eligible for the October update.

Enrollment in Period 2 ESU is required to access the October downloads for Exchange 2019 (CU14/CU15) and Exchange 2016 (CU23), per Microsoft’s announcement.

Exchange Server Subscription Edition RTM receives the October fixes under its listed support path. Microsoft’s note doesn’t attach an ESU condition to that edition.

What people are saying

Microsoft attributes the October fixes to responsible disclosure by security partners and findings from Microsoft’s own teams. That combination suggests pre‑release coordination on at least some issues.

The Exchange Team Blog post communicates the edition and CU scope plainly: Exchange Server Subscription Edition RTM, Exchange 2019 CU14/CU15 with ESU, and Exchange 2016 CU23 with ESU.

Microsoft’s phrasing emphasizes that these are vulnerability‑oriented updates. The company does not bill them as feature updates in the announcement.

What happens next

Administrators should verify whether their Exchange servers match the named builds: Subscription Edition RTM, Exchange 2019 CU14/CU15, or Exchange 2016 CU23.

Teams running Exchange 2019 or 2016 need to confirm Period 2 ESU enrollment before attempting to obtain the October 2026 downloads, per Microsoft’s requirements.

Change managers can plan maintenance windows aligned to these versions. Mixed environments may need staggered windows, depending on ESU status and edition.

Security teams should note that Microsoft credits both partner reports and internal discovery for the fixes, underlining the need to prioritize deployment when vulnerabilities are acknowledged.

Organizations that don’t meet the version or ESU conditions listed by Microsoft will need to address those gaps before they can apply the October 2026 Security Updates.