October Windows updates stall Exchange mail: the fix and its cost

The Windows Server updates Microsoft shipped on October 13 can knock on-premises Exchange servers over. Microsoft's update notes warn that some users cannot log in to Outlook on the web (OWA). In a post on October 16, its Exchange team added that mail queues can grow through the day until mail flow nearly stops, and that members of a database availability group (DAG) can lose quorum. A reboot may fix it for a while. Microsoft has given no date for a proper fix, and The Register reports it has not committed to an out-of-band update.

The four updates are KB5126646 for Windows Server 2025, KB5126655 for 2022, KB5126651 for 2019 and KB5126868 for 2016. Exchange Server 2016, 2019 and Subscription Edition (SE) can all be affected. The October Exchange security updates are not the cause, and the KB5126655 notes say a server does not need them installed to hit the problem.

For IT teams this lands on top of our Patch Tuesday advice last week to patch on-premises Exchange quickly. The patch is still needed. What changes is that a server can look healthy on day one and stall the next.

Is this server already failing?

Microsoft says the timing depends on load and that some servers may never be hit. Michel de Rooij, who writes the EighTwOne blog on Exchange, says symptoms show up about 24 hours after the update and come back on a similar cycle after each reboot. He also reproduced it in a lab with no real load, so a quiet server is not proof of safety.

Look for these in the event logs:

• Event ID 1006 in the Application log, from MSExchange Mailbox Replication, with the error MapiExceptionMdbOffline (ec=1142). Microsoft names the event ID and the error; de Rooij gives the source.
• On DAG members, Event ID 4082 from MSExchangeRepl reporting that the endpoint mapper has run out of endpoints. De Rooij reports this one.
• Databases that the Exchange admin center shows as mounted when they are not (de Rooij), and Outlook messages stuck in the Outbox (Microsoft).

What the registry fix trades away

Microsoft's workaround is to keep the update and, from an elevated command prompt, create a DWORD value named EpmapSavedContextCap set to 65536 under the key HKLM\SOFTWARE\Microsoft\Rpc. Then reboot, watch the server and raise the value if the problem returns. Microsoft says "Do not uninstall" the updates.

The KB5126655 notes explain the limit behind it. The October update capped the RPC Endpoint Mapper at 512 Endpoint Lookup calls at once by default, which Microsoft says "might not be sufficient under heavy load." De Rooij describes EpmapSavedContextCap as the setting for that 512 cap, so 65536 lifts it to 128 times the default.

The same October builds also fix CVE-2026-96300, an RPC Endpoint Mapper flaw that lets an unauthorized attacker deny service over the network through uncontrolled resource consumption. It is rated 5.9. Microsoft has not linked the two. De Rooij suspects the new cap is part of that fix, calls this a plausible explanation rather than a confirmed one, and warns that raising the value weakens the protection. So apply the setting only to Exchange servers that need it, not across the whole Windows Server estate.

The KB notes add that business customers can get a further mitigation through Microsoft Support. They do not say what it is.

Exchange 2016 and 2019 lose updates in 11 days

Exchange 2016 and 2019 servers have a second problem. Microsoft said in July that once October ends, Exchange 2016 and 2019 get no further updates, even for customers who paid for the second extended security update (ESU) period, and that the program will not be extended again. Messageware puts the end at October 31. A 2016 or 2019 server patched this month and kept running on a registry workaround is a server that stops getting fixes in 11 days.