Microsoft October Windows Updates Break Exchange Server Email Services

Key Takeaways

• Microsoft’s October 2026 Windows Server updates are causing significant disruptions to on-premises Exchange Server email services.
• Affected systems include Exchange Server 2016, 2019, and Subscription Edition, leading to issues like inaccessible webmail and undelivered messages.
• The problem stems from a new default limit on Endpoint Lookup calls introduced by the Windows Server updates, not the Exchange Server patches.
• Microsoft has provided a registry modification workaround to increase this limit and advises against uninstalling the Windows updates.

Microsoft Windows Server Updates Disrupt On-Premises Exchange Email Services

Microsoft has confirmed that specific Windows Server security updates, rolled out on October 13, 2026, are inadvertently causing severe operational issues for on-premises Exchange Server deployments. These disruptions manifest as blocked webmail access and failures in email delivery, impacting critical communication infrastructure for many organizations.

The problem primarily affects environments running Exchange Server 2016, Exchange Server 2019, and Exchange Server Subscription Edition. Microsoft has since released a temporary workaround and strongly advises system administrators to implement it rather than attempting to uninstall the problematic Windows updates.

Crucially, the root cause of these service interruptions lies within changes introduced by the Windows Server updates themselves, distinct from any separate October security updates for Exchange Server. This means that even Exchange environments that have not yet applied the latest Exchange-specific patches can still experience these failures if the underlying operating system updates are installed.

Affected Updates and Exchange Server Symptoms

Microsoft has identified four particular Windows updates responsible for these failures: KB5126646 for Windows Server 2025, KB5126655 for Windows Server 2022, KB5126651 for Windows Server 2019, and KB5126868 for Windows Server 2016. The severity and manifestation of symptoms can vary significantly depending on the specific workload of each server, with some systems potentially remaining unaffected.

End-users may encounter difficulties signing into Outlook on the web, or discover that emails sent via Outlook remain stuck in their Outbox. For administrators, indicators of compromise include expanding mail queues, unsuccessful mailbox access during replication processes, and problems with Database Availability Group members failing to achieve quorum. A temporary restoration of service might be achieved by restarting an affected server.

Administrators should be vigilant for specific error messages, such as MapiExceptionMdbOffline: Unable to make connection to the server. (hr=0x80004005, ec=1142). Additionally, affected systems may log Event ID 1006 in the Application log, providing a valuable diagnostic clue to confirm the outage aligns with Microsoft’s reported issue.

According to a Windows release health notice from Microsoft, the October updates introduced a new default limit of 512 concurrent Endpoint Lookup calls. This constraint is designed to manage memory consumption by the Endpoint Mapper, a Windows component integral to remote procedure call (RPC) communications. High-volume Exchange workloads are prone to exceeding this newly imposed default limit.

Increasing this limit allows the Endpoint Mapper to allocate more memory to handle the necessary RPC calls. Microsoft currently categorizes this issue as “mitigated” rather than fully “resolved,” indicating that their investigation is still active. An additional mitigation strategy is available directly through Microsoft Support for organizations facing persistent issues.

Microsoft’s Registry Workaround

The Exchange Team advisory from Microsoft instructs administrators to execute a specific command from an elevated Command Prompt on the affected Exchange server: reg add "HKLMSOFTWAREMicrosoftRpc" /v EpmapSavedContextCap /t REG_DWORD /d 65536 /f. A server restart is mandatory after applying this registry modification.

Following the reboot, administrators are advised to closely monitor their environment for any recurrence of the failures. Microsoft indicates that if problems resurface, the limit should be incrementally raised further, although the advisory does not specify subsequent values. The company has reported success with this approach in resolving customer cases it has managed.

Maintaining installed security updates remains a critical security practice. This disruption coincides with the nearing end of the final paid update period for Exchange 2016 and 2019. Microsoft has previously communicated that October 2026 marks the last scheduled Extended Security Update (ESU) release for these versions, with future updates exclusively provided for the Subscription Edition.

What You Should Do

• Immediately apply the registry workaround provided by Microsoft on all affected Exchange Servers: Open an elevated Command Prompt and run reg add "HKLMSOFTWAREMicrosoftRpc" /v EpmapSavedContextCap /t REG_DWORD /d 65536 /f, then restart the server.
• Monitor your Exchange environment closely for any recurring issues after applying the workaround. If problems persist, contact Microsoft Support for further guidance on increasing the limit.
• Do NOT uninstall the October 2026 Windows Server security updates, as this could expose your systems to known vulnerabilities.
• Verify that all Exchange Servers are running supported versions and are up-to-date with their respective security patches, especially given the upcoming end-of-life for ESU for Exchange 2016 and 2019.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.