Microsoft has confirmed that its October security update for Windows Server can leave Exchange email servers that organizations run on their own hardware unable to deliver mail or let users sign in to Outlook on the web, according to a known-issue notice the company posted late Friday. The problem, which German technology publisher heise reported earlier Friday, puts IT teams in a bind: the fastest way to restore mail could mean removing a security update, at a time when attackers are exploiting other flaws patched this month.
What Happened
The notice on Microsoft's Windows Server 2025 release health page was opened at 4:19 p.m. Pacific time Oct. 16 and last updated at 9:26 p.m. It traces the problem to the Oct. 13 Windows security update, KB5126646 for Windows Server 2025, and lists Windows Server 2025, 2022, 2019 and 2016 as affected. No Windows desktop versions are affected. Microsoft marks the issue "Mitigated," meaning a workaround exists, not that it is fixed.
The issue has been reported on Exchange Server 2016, 2019 and Subscription Edition. Microsoft says users may be unable to sign in to Outlook on the web, the browser version of Outlook; messages sent from Outlook may sit in the Outbox without being delivered; and Exchange may struggle to reach mailboxes while moving them between servers. Administrators may see an error reading "MapiExceptionMdbOffline" with event ID 1006 in the application log, or growing mail queues.
The cause lies in Windows, not Exchange. Microsoft said the October update introduced a default limit on memory used by the Endpoint Mapper, a Windows service that tells programs how to reach other services running on a server. The default ceiling of 512 simultaneous lookup requests may be too low for heavy workloads such as Exchange. Installing Microsoft's October Exchange Server security updates is not required for the problem to occur.
As a temporary fix, Microsoft points administrators to a registry change described in an Exchange team blog post that raises the number of simultaneous lookups allowed. A further mitigation is available through Microsoft Support for business. Microsoft said it is still investigating. Neither Microsoft nor heise has said how many organizations are affected.
Why It Matters
Removing the Windows update would make the symptoms go away, but it would also strip out the security fixes the update delivers. Microsoft's October release addressed more than 1,400 vulnerabilities, including a Windows Shell flaw attackers are already using to slip malicious files past Windows warnings. Microsoft's workaround keeps the update installed and changes one setting, which is the safer path for most organizations.
For executives, three questions for IT are worth asking: whether the organization still runs Exchange on its own servers, whether those servers received the October Windows updates, and whether any mail problems were handled with Microsoft's mitigation or by uninstalling security patches. Because Microsoft ties the failure to heavy load, an update that passed testing on a quiet server can still fail on a busy production system, which argues for watching mail queues closely after each Windows update, not only Exchange updates.
The episode also shows a cost of keeping email in-house. Organizations that run their own Exchange servers absorb both the patching workload and the risk that a Windows change breaks mail.
What to Watch
- Whether Microsoft issues a corrected Windows update. It released an out-of-band fix, KB5129235, within days for a Remote Desktop problem caused by the September update, according to the same release health page.
- Whether a permanent fix arrives with or before November's Patch Tuesday.
- Whether Microsoft discloses how many Exchange customers were affected or extends the list of affected workloads beyond Exchange.
