Full Report
Microsoft has confirmed that this month's Windows Server security updates are causing OWA sign-in and mail delivery issues on some Exchange Server systems. [...]
Analysis Summary
# Vulnerability: Not a Security Vulnerability (October 2026 Windows Server Update Regression Affecting Exchange)
> **Note:** The article describes a **functional regression**, not a security vulnerability. No CVE has been assigned, and no exploitation or security impact is reported. The template fields are filled accordingly.
## CVE Details
- CVE ID: N/A (no CVE referenced in the article)
- CVSS Score: N/A
- CWE: N/A
## Affected Systems
- Products: Exchange Server (on-premises) running on Windows Server 2019 and later, after installing October 2026 Windows security updates
- Versions: Article does not list specific Windows build numbers or Exchange cumulative update versions. Microsoft states that "any version of Exchange that runs on impacted versions of Windows could be impacted."
- Configurations: Impact varies with Exchange server load. Some servers may never be affected. Heavy workloads are more likely to hit the default limit.
## Vulnerability Description
This is a regression, not a vulnerability. The October 2026 Windows update introduced a default memory limit for Endpoint Mapper (RPC endpoint lookup). The default cap of 512 simultaneous Endpoint Lookup calls may be insufficient for Exchange under heavy load. When the cap is reached, the following symptoms can occur:
- OWA sign-in failures
- Outlook sign-in problems
- Messages stuck in the Outbox and not delivered
- Mailbox replication problems
- In some cases, `MapiExceptionMdbOffline: Unable to make connection to the server (hr=0x80004005, ec=1142)` and Event ID 1006 in the Application log
Microsoft states this is **not** a known issue linked to the October 2026 Exchange security updates, and it advises customers not to uninstall the updates.
## Exploitation
- Status: Not exploited (no attack activity reported; this is an availability regression)
- Complexity: N/A
- Attack Vector: N/A
## Impact
- Confidentiality: None reported
- Integrity: None reported
- Availability: Degraded. Affected users may be unable to sign in to OWA or Outlook, and outbound mail may be delayed or stuck.
## Remediation
### Patches
- No fix version is named in the article. Microsoft says it is working on a fix. Monitor the Windows release health dashboard and the Exchange team blog for an update.
### Workarounds
- Run the following from an elevated Command Prompt on the Exchange server, then reboot:
reg add "HKLM\SOFTWARE\Microsoft\Rpc" /v EpmapSavedContextCap /t REG_DWORD /d 65536 /f
This raises the Endpoint Mapper limit. Per the article, the value is 65536, versus the default of 512 simultaneous calls.
- Monitor the environment after restart. If symptoms recur, increase the Endpoint Mapper memory limit further.
- Verify the exact key name, value type, and recommended value against Microsoft's official advisory before deploying, since this summary relies on a secondary source.
## Detection
- Indicators:
- OWA sign-in failures or Outlook authentication problems after October 2026 updates
- Messages remaining in the Outbox or mail delivery delays
- Mailbox replication errors
- Application log Event ID 1006
- Error `MapiExceptionMdbOffline ... ec=1142`
- Methods:
- Check the Application event log for Event ID 1006.
- Review Exchange and OWA logs for MAPI connection errors.
- Check whether the Endpoint Mapper registry value is already set, and monitor RPC/Endpoint Mapper resource usage under load.
## References
- Microsoft Windows release health (Windows Server 2025 status): hxxps[:]//learn[.]microsoft[.]com/en-us/windows/release-health/status-windows-server-2025
- Microsoft Exchange Team blog on post-update instability: hxxps[:]//techcommunity[.]microsoft[.]com/blog/exchange/exchange-servers-may-become-unstable-after-installation-of-october-2026-windows-/4565382
- Exchange 2016/2019 ESU program end (BleepingComputer): hxxps[:]//www[.]bleepingcomputer[.]com/news/microsoft/microsoft-exchange-2016-and-2019-esu-program-ends-in-october/
- Exchange 2016/2019 ESU period 2 announcement (April 2026): hxxps[:]//techcommunity[.]microsoft[.]com/blog/exchange/announcing-period-2-exchange-20162019-extended-security-update-esu-program/4511603
**Operational note:** Exchange 2016 and 2019 extended security updates end this month, so plan migration or upgrade to a supported Exchange version alongside this issue.