Microsoft’s September security updates for Exchange Server, released on 8 September, address nine vulnerabilities. Microsoft rates all nine Important. None is rated Critical. Two carry CVSS scores above 9.
Code execution by email
CVE-2026-55007 allows an unauthenticated attacker to run code on an Exchange server by sending it an email with a crafted Visio attachment. The server executes the code when its content-indexing engine processes the message. No click, no preview, no credentials. Microsoft says exploitation requires the server to be under sustained low-memory conditions, which it calls uncommon in normal operation. CVSS 8.1.
Trend Micro’s Zero Day Initiative ranked it the most important patch in the entire September release, ahead of the two Windows zero-days Microsoft confirmed as exploited. Its reasoning: the attacker only needs to get it right once.
The 9.3 is cross-site scripting
CVE-2026-69356 is rated 9.3 and labelled spoofing. The underlying weakness is cross-site scripting, the same class as May’s CVE-2026-42897, which Microsoft said was exploited in the wild. These flaws run attacker script inside an Outlook on the web session, which can expose the mailbox and session data. They are not SMTP sender spoofing. A second spoofing flaw, CVE-2026-69361, is rated 6.5.
CVE-2026-69641, elevation of privilege within Exchange, is rated 9.1. CVE-2026-69380, rated 8.1, allows a low-privileged authenticated user to impersonate any user in the organisation. The remainder: an authenticated remote code execution flaw at 8.8, a denial of service at 7.5, a tampering flaw at 6.5 and an information disclosure at 5.9.
Who gets the patches
The updates ship for Exchange Server Subscription Edition. Exchange 2016 and 2019 are out of support. Microsoft says only customers enrolled in the Period 2 Extended Security Update programme receive updates released between May and October 2026. Anyone on 2016 or 2019 without Period 2 ESU has had no security updates since May and should migrate to SE.
Even with ESU, Exchange 2016 does not get the full set. Franky’s Web reports that the 2016 CU23 update closes eight of the nine and omits CVE-2026-55007. The flaw that works by sending an email stays open on Exchange 2016.
Known issues
Microsoft’s KB5121608 lists two known issues in this update: published .ics calendars return HTTP 500 to calendar applications, and free/busy lookups fail for delegated mailboxes in hybrid deployments that use the Graph API only. The update resolves two earlier problems: hybrid free/busy through Graph shifting busy times by the requester’s time zone, and wrapper messages appearing in shared mailboxes after the June update. Microsoft recommends running the Exchange Health Checker after installation.
For anyone running on-premises Exchange with an internet-facing mail path, CVE-2026-55007 is the patch to apply first. For anyone on Exchange 2016, it is the patch you cannot apply.
