September 2026 Exchange Server Security Updates (KB5121608): Three Vulnerabilities Worth Patching Now

Microsoft’s September 2026 Exchange Server security updates (KB5121608) address nine vulnerabilities, three of them serious enough that any Exchange admin who hasn’t patched yet should treat this as urgent, not routine. One is a spoofing flaw with a CVSS score of 9.3. None are currently known to be under active exploitation, but that status changes quickly once patch details are public, and Exchange has a well-documented history of becoming an active exploitation target within days of a patch release.

The three vulnerabilities that matter most

Microsoft classified all nine issues in this release as “Important” rather than “Critical,” but severity classification and real-world risk aren’t always the same thing, especially for internet-facing Exchange servers. Three stand out:

• CVE-2026-69356 (CVSS 9.3, Spoofing): allows an attacker to impersonate a different sender. For an email system, a high-severity spoofing flaw is directly relevant to phishing and business email compromise risk, not just a theoretical integrity issue.
• CVE-2026-69641 (CVSS 9.1, Elevation of Privilege): lets an attacker gain elevated privileges within Exchange. Combined with any initial foothold, an EoP flaw at this severity is a realistic path toward full server compromise.
• CVE-2026-69355 (CVSS 8.8, Remote Code Execution): allows an authenticated attacker to execute code on the server. Requiring authentication lowers the immediate risk somewhat compared to an unauthenticated RCE, but any RCE on Exchange, historically one of the most targeted pieces of on-premises infrastructure, deserves urgent patching regardless.

Who this actually applies to

The update is available for Exchange Server Subscription Edition (SE), and for Exchange Server 2016 and 2019 specifically through the Extended Security Update (ESU) program, meaning organizations still running 2016 or 2019 without an active ESU agreement will not receive this patch and remain exposed. If your organization is in that position, this is worth escalating as a business risk conversation, not just a technical backlog item, since running unpatched, unsupported Exchange with known CVEs published against it is a materially different risk posture than running a fully patched, supported version.

Applying the update correctly

# Confirm current build number before patching
Get-ExchangeServer | Get-ExchangeServer -Status | Select-Object Name, AdminDisplayVersion

# Always run Health Checker before and after applying a CU/security update
# (download the latest version directly from Microsoft's official GitHub release page)
.\HealthChecker.ps1 -Server yourservername

Standard Exchange patching discipline still applies here: confirm you’re on a supported cumulative update baseline first, since security updates are only released against certain CU levels and won’t install cleanly against an outdated one. Take a verified backup or snapshot before applying, run the update during a maintenance window with Exchange services stopped cleanly, and run Health Checker again afterward to confirm services actually returned to a healthy state, not just that the installer reported success.

Don’t stop at patching alone

Given the spoofing and elevation-of-privilege severity in this specific release, this is a reasonable moment to also verify DKIM and DMARC enforcement are actually active on your Exchange Online or hybrid environment, since a spoofing vulnerability is meaningfully less dangerous against a domain that already has strict outbound authentication and inbound DMARC enforcement in place. Verify Extended Protection is enabled on internet-facing Exchange servers as well, since Microsoft has repeatedly reinforced this as a critical mitigation layer against a broad class of Exchange server-side attacks, independent of any single CVE.

Frequently asked questions

Are any of these September 2026 CVEs known to be actively exploited right now?
As of Microsoft’s release, none are reported as actively exploited. That status is a snapshot at release time, not a guarantee going forward, exploitation activity for Exchange vulnerabilities has historically emerged within days to weeks of patch details becoming public, so treat “not currently exploited” as a reason to patch promptly, not a reason to delay.

We’re on Exchange 2019 without an active ESU agreement. What are our real options?
Without ESU, you will not receive this or future security updates, leaving your server permanently exposed to newly disclosed vulnerabilities. The two realistic paths are enrolling in ESU to buy time for a migration, or accelerating migration to Exchange Server Subscription Edition or Exchange Online directly. Running an unpatched, unsupported mail server with known CVEs is a risk worth escalating explicitly to whoever owns that budget decision, rather than quietly absorbing it as a technical team’s problem.

Does patching alone fully address the spoofing vulnerability (CVE-2026-69356)?
Patching closes the specific vulnerability, but spoofing risk more broadly is also addressed by your domain’s own SPF, DKIM, and DMARC configuration, which governs whether spoofed mail using your domain is rejected by receiving servers regardless of how the spoofing was attempted. Patch the CVE and verify your authentication records are properly enforced, treating them as complementary layers rather than either one alone being sufficient.