Microsoft has confirmed that security updates released for Windows Server on October 13 can interfere with on-premises Exchange Server operations. Affected organizations may see Outlook on the web become unavailable, messages remain in users’ Outboxes, and mail queues grow as database connectivity falters.

The problem can affect Exchange Server 2016, Exchange Server 2019, and Exchange Server Subscription Edition. Microsoft has provided a registry workaround and explicitly advises administrators not to remove the Windows security updates. The company currently describes the issue as mitigated while its investigation continues.

The operating system update is the trigger

This incident is easy to misdiagnose because it coincides with Microsoft’s October Exchange security releases. However, the confirmed cause is a change delivered through Windows Server updates, not the separate Exchange patches. An Exchange host may therefore experience the failure even if the latest Exchange-specific update has not been installed.

Microsoft has linked the behavior to four Windows packages: KB5126646 for Windows Server 2025, KB5126655 for Windows Server 2022, KB5126651 for Windows Server 2019, and KB5126868 for Windows Server 2016. Impact varies by workload, so two apparently similar servers may behave differently and some systems may never show symptoms.

The updates introduced a default ceiling of 512 simultaneous Endpoint Lookup calls. Endpoint Mapper supports remote procedure call communications, and the limit is intended to constrain memory consumption. Busy Exchange environments can exceed that allowance, causing dependent services and database communications to fail.

Symptoms administrators may encounter

For end users, the most visible sign is an inability to authenticate to Outlook on the web. Outlook clients may appear to send messages while leaving them stuck locally. Behind the scenes, administrators can encounter expanding transport queues, mailbox access failures during replication, or Database Availability Group members that cannot maintain quorum.

Restarting a server may temporarily restore operation, but it does not address the underlying capacity limit. Affected hosts can also log Application Event ID 1006. Another useful diagnostic clue is the error MapiExceptionMdbOffline, accompanied by a message that the client cannot connect to the server and the values hr=0x80004005 and ec=1142.

Because these indicators overlap with other Exchange outages, response teams should correlate the timing of the first failures with Windows update installation and inspect all members of a high-availability group. A partial failure can create confusing symptoms when traffic is redirected among healthy and unhealthy nodes.

Microsoft’s registry mitigation

Microsoft’s Exchange guidance raises the Endpoint Mapper saved-context capacity. From an elevated Command Prompt on each affected Exchange server, administrators can run the following command:

reg add "HKLM\SOFTWARE\Microsoft\Rpc" /v EpmapSavedContextCap /t REG_DWORD /d 65536 /f

The server must be restarted after applying the change. Microsoft says this adjustment has resolved the problem in customer environments it has handled. If failures recur, the company advises increasing the limit further, although its public guidance does not specify a universal second value. Organizations needing an additional mitigation can contact Microsoft Support.

• Confirm the affected Windows update and document when symptoms began.
• Apply the registry change through normal change-control procedures.
• Restart one server at a time where resilient Exchange architecture permits it.
• Monitor mail queues, database replication, DAG quorum, webmail access, and Event ID 1006.
• Escalate recurring failures to Microsoft rather than repeatedly rebooting production hosts.

Keep the security fixes in place

Uninstalling a security update can restore old, vulnerable code and should not be the default response to an availability problem. Microsoft’s position is to retain the October Windows updates and use the mitigation while engineering work continues. Administrators should also avoid assuming that installing or removing the separate Exchange update will solve this particular fault.

The timing adds pressure for organizations still operating Exchange 2016 or 2019. October 2026 is their final scheduled Extended Security Update release, while future routine security servicing is focused on Exchange Server Subscription Edition. Teams troubleshooting the outage should use the incident as an opportunity to confirm support status, patch governance, tested rollback plans, and a migration path for aging deployments.