Affected Systems
On-premises Exchange Server systems running on Windows Server 2019 and later, after installing October 2026 Windows Server security updates. All Exchange versions on affected Windows Server versions are potentially impacted. Issue is not related to Exchange Server updates themselves.
Exploitation Status
Not a vulnerability. This is a compatibility issue caused by Microsoft's October 2026 Windows Server security updates introducing a default 512-call limit on Endpoint Mapper memory allocation, insufficient for Exchange Server under heavy load. No exploitation involved.
Business Impact
Organizations running Exchange Server on Windows Server 2019+ may experience email service disruption including: inability to sign in to Outlook Web Access (OWA), emails stuck in Outbox without delivery, mailbox access failures during replication, and MapiExceptionMdbOffline errors (Event ID 1006). Impact severity varies by server load; some systems may not be affected. This directly impacts business communication and productivity.
Urgency
🔴 Immediate
Recommended Actions
- Identify all on-premises Exchange Servers running on Windows Server 2019 or later that received October 2026 Windows security updates
- Monitor Exchange Server application logs for Event ID 1006 and MapiExceptionMdbOffline errors indicating Endpoint Mapper memory exhaustion
- Apply Microsoft's registry workaround on affected systems: run 'reg add "HKLM\SOFTWARE\Microsoft\Rpc" /v EpmapSavedContextCap /t REG_DWORD /d 65536 /f' from elevated Command Prompt, then reboot
- After reboot, monitor Exchange environment performance and mail flow; increase EpmapSavedContextCap value further if issues recur on high-load servers
- Do NOT uninstall October 2026 Exchange Server security updates, as the issue stems from Windows Server updates, not Exchange updates