{"id":59173,"date":"2026-10-18T08:03:43","date_gmt":"2026-10-17T22:03:43","guid":{"rendered":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/10\/18\/is-your-exchange-server-patched-october-2026-security-checklist\/"},"modified":"2026-10-18T08:05:09","modified_gmt":"2026-10-17T22:05:09","slug":"is-your-exchange-server-patched-october-2026-security-checklist","status":"publish","type":"post","link":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/10\/18\/is-your-exchange-server-patched-october-2026-security-checklist\/","title":{"rendered":"Is Your Exchange Server Patched October 2026 Security Checklist"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">In this blog post Is Your Exchange Server Patched October 2026 Security Checklist we will explain how to confirm your Exchange environment is protected, reduce the risk of email disruption and identify servers that should no longer remain in production.<\/p>\n\n\n\n<!--more-->\n\n\n\n<p class=\"wp-block-paragraph\">The concern for business leaders is simple. Email may be working normally while an overlooked Exchange server, hybrid management server or administrator workstation remains exposed. October 2026 also brings a separate Windows Server update issue that can make Exchange unstable, so checking the update history alone is not enough.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What Exchange Server patching actually involves<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Microsoft Exchange Server is the software that provides business email, calendars, shared mailboxes and related services when these systems are hosted on your own servers. Even organisations using Microsoft 365 may still have an on-premises Exchange server for hybrid management or integration with older business applications.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Exchange depends on several layers. The underlying Windows Server operating system must be patched, Exchange must be on an eligible Cumulative Update or CU, and the latest Exchange Security Update or SU must be installed. A CU provides the supported software foundation, while an SU fixes newly identified security weaknesses.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This distinction matters because installing Windows updates does not automatically mean Exchange is secure. Likewise, installing the Exchange update without checking Windows Server health can leave the business with delayed email, failed webmail or an unstable database cluster.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Why the October 2026 update deserves attention<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Microsoft released the regular October Exchange security updates on 13 October 2026 for Exchange Server Subscription Edition. Updates for Exchange Server 2019 CU14, Exchange Server 2019 CU15 and Exchange Server 2016 CU23 are only available to organisations enrolled in the relevant Extended Security Update program.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">More importantly, October 2026 is the final month of Extended Security Updates for Exchange 2016 and 2019. After this release, Microsoft plans to issue new Exchange security updates only for Exchange Subscription Edition. Remaining on Exchange 2016 or 2019 therefore becomes an ongoing business risk rather than a temporary patching delay.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">The October 2026 Exchange security checklist<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">1. Find every Exchange server and management workstation<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Start with a complete inventory. This includes production servers, disaster recovery servers, hybrid servers, test systems and computers containing the Exchange management tools.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Exchange Online customers are already protected within Microsoft\u2019s cloud service. However, any Exchange servers or management tools remaining in the organisation still need to be updated.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">An administrator can check the known servers from the Exchange Management Shell with:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Get-ExchangeServer | Format-Table Name, Edition, AdminDisplayVersion<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Do not rely solely on this command. Compare the results with virtual machine inventories, Windows Server records, firewall rules, backup jobs and Microsoft 365 hybrid configuration.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">2. Confirm the exact Exchange version and update<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">October has included more than one Exchange-related security release. This makes the installed build number more useful than a screenshot showing that an update was attempted.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For the regular 13 October release, the expected update depends on the Exchange version:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Exchange Subscription Edition RTM<\/strong> \u2014 SU11, KB5128895.<\/li>\n<li><strong>Exchange Server 2019 CU15<\/strong> \u2014 SU12, KB5128896.<\/li>\n<li><strong>Exchange Server 2019 CU14<\/strong> \u2014 SU15, KB5128897.<\/li>\n<li><strong>Exchange Server 2016 CU23<\/strong> \u2014 SU26, KB5128898.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Exchange 2016 and 2019 updates require Extended Security Update entitlement. If your provider cannot show both the CU and SU installed on each server, ask for further evidence rather than accepting that automatic updates are enabled.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The Exchange Health Checker should also be run before and after deployment. It checks the build, configuration and manual actions that may not be completed by the installer.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>.\\HealthChecker.ps1\n\nGet-Command ExSetup.exe | ForEach-Object {\n $_.FileVersionInfo\n}<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">3. Check backups and business dependencies<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Before patching, confirm that backups are recent, application-aware and recoverable. A successful backup job is not the same as a tested recovery process.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Document the services that depend on Exchange, including scanners, finance systems, customer platforms, multifunction printers and applications that send automated notifications. This prevents an apparently successful update from silently stopping invoices, alerts or customer emails.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For environments with multiple Exchange servers, verify database replication and server health before taking one server offline. Beginning a patch cycle with an unhealthy cluster greatly increases the chance of an outage.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">4. Deploy through a controlled maintenance window<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Restart the Exchange server before installing the update, use an elevated administrator session and restart it again afterwards. In multi-server environments, update one server at a time and confirm service health before continuing.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">A maintenance window should include time for validation and rollback, not just installation. This is one of the lessons covered in our article on why mid-market patch validation cannot be optional.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">5. Test the services employees actually use<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">A completed installer does not prove that Exchange is healthy. Test internal and external mail flow, Outlook connectivity, Outlook on the web, shared mailboxes, mobile access, calendars and application-generated messages.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Also monitor email queues, Windows event logs, Exchange services and database availability for several hours. Problems can emerge gradually as server load increases.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">6. Separate Exchange update issues from Windows update issues<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Microsoft has reported that October 2026 Windows Server updates can cause Exchange 2016, 2019 and Subscription Edition systems to become unstable. Symptoms can include failed webmail access, growing email queues, slow or stopped mail flow and database availability group communication problems.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The affected Windows updates include KB5126646 for Windows Server 2025, KB5126655 for Windows Server 2022, KB5126651 for Windows Server 2019 and KB5126868 for Windows Server 2016. Microsoft advises against uninstalling these security updates and has provided a registry-based mitigation followed by a server restart.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If your environment is already experiencing these symptoms, follow our guide to triage Exchange Server instability after the October 2026 updates before making repeated or unplanned changes.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">7. Keep evidence for Essential 8 and governance reviews<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The Essential 8 is the Australian government\u2019s cybersecurity framework for reducing common security risks. Two of its core strategies are patching applications and patching operating systems.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Keep the server inventory, approved change record, installed build numbers, Health Checker results, test results and any accepted exceptions. Australian Signals Directorate guidance also stresses that organisations should verify patches were successfully applied rather than assuming deployment tools completed the job.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">A common mid-market risk scenario<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Consider a 200-person professional services firm that moved all user mailboxes to Microsoft 365 two years ago. Outlook works, staff use multi-factor authentication and management believes the old Exchange environment is no longer relevant.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">However, one Exchange 2016 server remains for hybrid administration and an accounting application still sends email through it. If that server misses the final October update, the company retains an internet-connected system that will receive no protection against future Exchange vulnerabilities.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The short-term outcome is unnecessary security exposure. The longer-term outcome may be emergency migration work, failed compliance reviews or a business email outage that costs far more than a planned upgrade.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Patching is only part of the decision<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">If you are still running Exchange 2016 or 2019, the October checklist should finish with a documented retirement or migration plan. The practical choices are generally Exchange Subscription Edition, Exchange Online or removing the final on-premises dependency from an existing hybrid environment.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">CloudProInc brings more than 20 years of enterprise IT experience to these decisions. As a Melbourne-based Microsoft Partner and hands-on cloud and security consultancy, we help organisations validate Exchange, Azure and Microsoft 365 environments without turning the review into a large, open-ended project.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If you are unsure whether every Exchange server is patched, supported and still required, we are happy to take a look and give you a clear view of the risk and next steps \u2014 no strings attached.<\/p>\n\n\n","protected":false},"excerpt":{"rendered":"<p>Use this practical October 2026 checklist to confirm Exchange patch status, avoid update-related disruption and address the end of security support for Exchange 2016 and 2019.<\/p>\n","protected":false},"author":1,"featured_media":59175,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_et_pb_use_builder":"","_et_pb_old_content":"","_et_gb_content_width":"","_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":true,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[13],"tags":[],"class_list":["post-59173","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blog"],"jetpack-related-posts":[{"id":59207,"url":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/10\/19\/october-patch-tuesday-exchange-server-stabilisation-checklist\/","url_meta":{"origin":59173,"position":0},"title":"October Patch Tuesday Exchange Server Stabilisation Checklist","author":"CPI Staff","date":"October 19, 2026","format":false,"excerpt":"A practical post-patch checklist to restore Exchange stability, protect mail flow and turn October 2026 update disruption into a safer patching process.","rel":"","context":"In &quot;Blog&quot;","block_context":{"text":"Blog","link":"https:\/\/www.cloudproinc.com.au\/index.php\/category\/blog\/"},"img":{"alt_text":"","src":"\/wp-content\/uploads\/2026\/10\/october-patch-tuesday-exchange-server-stabilisation-checklist.png","width":350,"height":200,"srcset":"\/wp-content\/uploads\/2026\/10\/october-patch-tuesday-exchange-server-stabilisation-checklist.png 1x, \/wp-content\/uploads\/2026\/10\/october-patch-tuesday-exchange-server-stabilisation-checklist.png 1.5x, \/wp-content\/uploads\/2026\/10\/october-patch-tuesday-exchange-server-stabilisation-checklist.png 2x, \/wp-content\/uploads\/2026\/10\/october-patch-tuesday-exchange-server-stabilisation-checklist.png 3x, \/wp-content\/uploads\/2026\/10\/october-patch-tuesday-exchange-server-stabilisation-checklist.png 4x"},"classes":[]},{"id":59170,"url":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/10\/18\/how-to-triage-exchange-server-instability-after-october-2026-updates\/","url_meta":{"origin":59173,"position":1},"title":"How to Triage Exchange Server Instability After October 2026 Updates","author":"CPI Staff","date":"October 18, 2026","format":false,"excerpt":"October 2026 Windows Server updates can disrupt on-premises Exchange. Learn how to stabilise mail flow and decide whether Exchange Online is now the lower-risk option.","rel":"","context":"In &quot;Blog&quot;","block_context":{"text":"Blog","link":"https:\/\/www.cloudproinc.com.au\/index.php\/category\/blog\/"},"img":{"alt_text":"","src":"\/wp-content\/uploads\/2026\/10\/how-to-triage-exchange-server-instability-after-october-2026-updates.png","width":350,"height":200,"srcset":"\/wp-content\/uploads\/2026\/10\/how-to-triage-exchange-server-instability-after-october-2026-updates.png 1x, \/wp-content\/uploads\/2026\/10\/how-to-triage-exchange-server-instability-after-october-2026-updates.png 1.5x, \/wp-content\/uploads\/2026\/10\/how-to-triage-exchange-server-instability-after-october-2026-updates.png 2x, \/wp-content\/uploads\/2026\/10\/how-to-triage-exchange-server-instability-after-october-2026-updates.png 3x, \/wp-content\/uploads\/2026\/10\/how-to-triage-exchange-server-instability-after-october-2026-updates.png 4x"},"classes":[]},{"id":59257,"url":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/10\/20\/sql-server-october-2026-patching-and-modernisation-checklist\/","url_meta":{"origin":59173,"position":2},"title":"SQL Server October 2026 Patching and Modernisation Checklist","author":"CPI Staff","date":"October 20, 2026","format":false,"excerpt":"Use this practical checklist to patch SQL Server safely, test critical integrations, meet Essential 8 expectations and decide whether ageing database platforms should be upgraded or moved to Azure.","rel":"","context":"In &quot;Backup &amp; Disaster Recovery&quot;","block_context":{"text":"Backup &amp; Disaster Recovery","link":"https:\/\/www.cloudproinc.com.au\/index.php\/category\/backup-disaster-recovery\/"},"img":{"alt_text":"","src":"\/wp-content\/uploads\/2026\/10\/sql-server-october-2026-patching-and-modernisation-checklist.png","width":350,"height":200,"srcset":"\/wp-content\/uploads\/2026\/10\/sql-server-october-2026-patching-and-modernisation-checklist.png 1x, \/wp-content\/uploads\/2026\/10\/sql-server-october-2026-patching-and-modernisation-checklist.png 1.5x, \/wp-content\/uploads\/2026\/10\/sql-server-october-2026-patching-and-modernisation-checklist.png 2x, \/wp-content\/uploads\/2026\/10\/sql-server-october-2026-patching-and-modernisation-checklist.png 3x, \/wp-content\/uploads\/2026\/10\/sql-server-october-2026-patching-and-modernisation-checklist.png 4x"},"classes":[]},{"id":59204,"url":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/10\/19\/patch-now-what-october-2026-sql-server-updates-mean-in-australia\/","url_meta":{"origin":59173,"position":3},"title":"Patch Now What October 2026 SQL Server Updates Mean in Australia","author":"CPI Staff","date":"October 19, 2026","format":false,"excerpt":"Microsoft\u2019s October 2026 SQL Server updates close serious security gaps but may disrupt some linked-server connections. Here is a practical patching plan for Australian mid-market teams.","rel":"","context":"In &quot;Blog&quot;","block_context":{"text":"Blog","link":"https:\/\/www.cloudproinc.com.au\/index.php\/category\/blog\/"},"img":{"alt_text":"","src":"\/wp-content\/uploads\/2026\/10\/patch-now-what-october-2026-sql-server-updates-mean-in-australia.png","width":350,"height":200,"srcset":"\/wp-content\/uploads\/2026\/10\/patch-now-what-october-2026-sql-server-updates-mean-in-australia.png 1x, \/wp-content\/uploads\/2026\/10\/patch-now-what-october-2026-sql-server-updates-mean-in-australia.png 1.5x, \/wp-content\/uploads\/2026\/10\/patch-now-what-october-2026-sql-server-updates-mean-in-australia.png 2x, \/wp-content\/uploads\/2026\/10\/patch-now-what-october-2026-sql-server-updates-mean-in-australia.png 3x, \/wp-content\/uploads\/2026\/10\/patch-now-what-october-2026-sql-server-updates-mean-in-australia.png 4x"},"classes":[]},{"id":59384,"url":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/10\/24\/sql-server-2025-cu10-and-azure-sql-alerts-for-safer-operations\/","url_meta":{"origin":59173,"position":4},"title":"SQL Server 2025 CU10 and Azure SQL Alerts for Safer Operations","author":"CPI Staff","date":"October 24, 2026","format":false,"excerpt":"A practical playbook for deploying SQL Server 2025 CU10 safely and using Azure SQL Database Hub alerts to catch performance problems before users notice.","rel":"","context":"In &quot;Azure&quot;","block_context":{"text":"Azure","link":"https:\/\/www.cloudproinc.com.au\/index.php\/category\/microsoft-azure\/"},"img":{"alt_text":"","src":"\/wp-content\/uploads\/2026\/10\/sql-server-2025-cu10-and-azure-sql-alerts-for-safer-operations.png","width":350,"height":200,"srcset":"\/wp-content\/uploads\/2026\/10\/sql-server-2025-cu10-and-azure-sql-alerts-for-safer-operations.png 1x, \/wp-content\/uploads\/2026\/10\/sql-server-2025-cu10-and-azure-sql-alerts-for-safer-operations.png 1.5x, \/wp-content\/uploads\/2026\/10\/sql-server-2025-cu10-and-azure-sql-alerts-for-safer-operations.png 2x, \/wp-content\/uploads\/2026\/10\/sql-server-2025-cu10-and-azure-sql-alerts-for-safer-operations.png 3x, \/wp-content\/uploads\/2026\/10\/sql-server-2025-cu10-and-azure-sql-alerts-for-safer-operations.png 4x"},"classes":[]},{"id":560,"url":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/10\/12\/hardening-azure-wiz-outpost\/","url_meta":{"origin":59173,"position":5},"title":"Hardening Azure Wiz Outpost","author":"CPI Staff","date":"October 12, 2026","format":false,"excerpt":"In this Wiz outpost blog post, we will explain the process of hardening Azure Wiz outpost and follow best practices. Table of contentsHardening Azure Wiz OutpostUse a Dedicated SubscriptionEnable Microsoft Defender for CloudEnable auto-provisioning of Microsoft Monitoring AgentCreate Activity Log AlertsRelated Articles Hardening Azure Wiz Outpost Azure Wiz outposts allow\u2026","rel":"","context":"In &quot;Azure&quot;","block_context":{"text":"Azure","link":"https:\/\/www.cloudproinc.com.au\/index.php\/category\/microsoft-azure\/"},"img":{"alt_text":"","src":"\/wp-content\/uploads\/2024\/08\/Hardening-Azure-Wiz-outpost.webp","width":350,"height":200,"srcset":"\/wp-content\/uploads\/2024\/08\/Hardening-Azure-Wiz-outpost.webp 1x, \/wp-content\/uploads\/2024\/08\/Hardening-Azure-Wiz-outpost.webp 1.5x, \/wp-content\/uploads\/2024\/08\/Hardening-Azure-Wiz-outpost.webp 2x"},"classes":[]}],"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"\/wp-content\/uploads\/2026\/10\/is-your-exchange-server-patched-october-2026-security-checklist.png","_links":{"self":[{"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/posts\/59173","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/comments?post=59173"}],"version-history":[{"count":1,"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/posts\/59173\/revisions"}],"predecessor-version":[{"id":59174,"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/posts\/59173\/revisions\/59174"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/media\/59175"}],"wp:attachment":[{"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/media?parent=59173"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/categories?post=59173"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/tags?post=59173"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}