Is Your Exchange Server Patched October 2026 Security Checklist

In this blog post Is Your Exchange Server Patched October 2026 Security Checklist we will explain how to confirm your Exchange environment is protected, reduce the risk of email disruption and identify servers that should no longer remain in production.

The concern for business leaders is simple. Email may be working normally while an overlooked Exchange server, hybrid management server or administrator workstation remains exposed. October 2026 also brings a separate Windows Server update issue that can make Exchange unstable, so checking the update history alone is not enough.

What Exchange Server patching actually involves

Microsoft Exchange Server is the software that provides business email, calendars, shared mailboxes and related services when these systems are hosted on your own servers. Even organisations using Microsoft 365 may still have an on-premises Exchange server for hybrid management or integration with older business applications.

Exchange depends on several layers. The underlying Windows Server operating system must be patched, Exchange must be on an eligible Cumulative Update or CU, and the latest Exchange Security Update or SU must be installed. A CU provides the supported software foundation, while an SU fixes newly identified security weaknesses.

This distinction matters because installing Windows updates does not automatically mean Exchange is secure. Likewise, installing the Exchange update without checking Windows Server health can leave the business with delayed email, failed webmail or an unstable database cluster.

Why the October 2026 update deserves attention

Microsoft released the regular October Exchange security updates on 13 October 2026 for Exchange Server Subscription Edition. Updates for Exchange Server 2019 CU14, Exchange Server 2019 CU15 and Exchange Server 2016 CU23 are only available to organisations enrolled in the relevant Extended Security Update program.

More importantly, October 2026 is the final month of Extended Security Updates for Exchange 2016 and 2019. After this release, Microsoft plans to issue new Exchange security updates only for Exchange Subscription Edition. Remaining on Exchange 2016 or 2019 therefore becomes an ongoing business risk rather than a temporary patching delay.

The October 2026 Exchange security checklist

1. Find every Exchange server and management workstation

Start with a complete inventory. This includes production servers, disaster recovery servers, hybrid servers, test systems and computers containing the Exchange management tools.

Exchange Online customers are already protected within Microsoft’s cloud service. However, any Exchange servers or management tools remaining in the organisation still need to be updated.

An administrator can check the known servers from the Exchange Management Shell with:

Get-ExchangeServer | Format-Table Name, Edition, AdminDisplayVersion

Do not rely solely on this command. Compare the results with virtual machine inventories, Windows Server records, firewall rules, backup jobs and Microsoft 365 hybrid configuration.

2. Confirm the exact Exchange version and update

October has included more than one Exchange-related security release. This makes the installed build number more useful than a screenshot showing that an update was attempted.

For the regular 13 October release, the expected update depends on the Exchange version:

• Exchange Subscription Edition RTM — SU11, KB5128895.
• Exchange Server 2019 CU15 — SU12, KB5128896.
• Exchange Server 2019 CU14 — SU15, KB5128897.
• Exchange Server 2016 CU23 — SU26, KB5128898.

Exchange 2016 and 2019 updates require Extended Security Update entitlement. If your provider cannot show both the CU and SU installed on each server, ask for further evidence rather than accepting that automatic updates are enabled.

The Exchange Health Checker should also be run before and after deployment. It checks the build, configuration and manual actions that may not be completed by the installer.

.\HealthChecker.ps1

Get-Command ExSetup.exe | ForEach-Object {
 $_.FileVersionInfo
}

3. Check backups and business dependencies

Before patching, confirm that backups are recent, application-aware and recoverable. A successful backup job is not the same as a tested recovery process.

Document the services that depend on Exchange, including scanners, finance systems, customer platforms, multifunction printers and applications that send automated notifications. This prevents an apparently successful update from silently stopping invoices, alerts or customer emails.

For environments with multiple Exchange servers, verify database replication and server health before taking one server offline. Beginning a patch cycle with an unhealthy cluster greatly increases the chance of an outage.

4. Deploy through a controlled maintenance window

Restart the Exchange server before installing the update, use an elevated administrator session and restart it again afterwards. In multi-server environments, update one server at a time and confirm service health before continuing.

A maintenance window should include time for validation and rollback, not just installation. This is one of the lessons covered in our article on why mid-market patch validation cannot be optional.

5. Test the services employees actually use

A completed installer does not prove that Exchange is healthy. Test internal and external mail flow, Outlook connectivity, Outlook on the web, shared mailboxes, mobile access, calendars and application-generated messages.

Also monitor email queues, Windows event logs, Exchange services and database availability for several hours. Problems can emerge gradually as server load increases.

6. Separate Exchange update issues from Windows update issues

Microsoft has reported that October 2026 Windows Server updates can cause Exchange 2016, 2019 and Subscription Edition systems to become unstable. Symptoms can include failed webmail access, growing email queues, slow or stopped mail flow and database availability group communication problems.

The affected Windows updates include KB5126646 for Windows Server 2025, KB5126655 for Windows Server 2022, KB5126651 for Windows Server 2019 and KB5126868 for Windows Server 2016. Microsoft advises against uninstalling these security updates and has provided a registry-based mitigation followed by a server restart.

If your environment is already experiencing these symptoms, follow our guide to triage Exchange Server instability after the October 2026 updates before making repeated or unplanned changes.

7. Keep evidence for Essential 8 and governance reviews

The Essential 8 is the Australian government’s cybersecurity framework for reducing common security risks. Two of its core strategies are patching applications and patching operating systems.

Keep the server inventory, approved change record, installed build numbers, Health Checker results, test results and any accepted exceptions. Australian Signals Directorate guidance also stresses that organisations should verify patches were successfully applied rather than assuming deployment tools completed the job.

A common mid-market risk scenario

Consider a 200-person professional services firm that moved all user mailboxes to Microsoft 365 two years ago. Outlook works, staff use multi-factor authentication and management believes the old Exchange environment is no longer relevant.

However, one Exchange 2016 server remains for hybrid administration and an accounting application still sends email through it. If that server misses the final October update, the company retains an internet-connected system that will receive no protection against future Exchange vulnerabilities.

The short-term outcome is unnecessary security exposure. The longer-term outcome may be emergency migration work, failed compliance reviews or a business email outage that costs far more than a planned upgrade.

Patching is only part of the decision

If you are still running Exchange 2016 or 2019, the October checklist should finish with a documented retirement or migration plan. The practical choices are generally Exchange Subscription Edition, Exchange Online or removing the final on-premises dependency from an existing hybrid environment.

CloudProInc brings more than 20 years of enterprise IT experience to these decisions. As a Melbourne-based Microsoft Partner and hands-on cloud and security consultancy, we help organisations validate Exchange, Azure and Microsoft 365 environments without turning the review into a large, open-ended project.

If you are unsure whether every Exchange server is patched, supported and still required, we are happy to take a look and give you a clear view of the risk and next steps — no strings attached.