Exchange Server Vulnerability CVE-2026-70571: Critical RCE, last patch for 2016/2019

Summary

With its October updates on 13 October 2026, Microsoft fixed a critical remote code execution vulnerability in Exchange Server: CVE-2026-70571 (CWE-121: stack-based buffer overflow). According to Microsoft, an unauthenticated attacker can send a specially crafted email to trigger an internal content-conversion process and execute code on the server; no user interaction is required, but the attacker needs deep knowledge of the target environment (attack complexity is high).

• CVSS 3.1: 8.1 (vector: AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) – Microsoft severity: Critical
• Actively exploited: No, according to Microsoft; exploitation is marked "more likely" (Exploitation More Likely).
• Remediation status: Patch available (see table below).

Affected versions and fixes

The same updates also fix five further Exchange vulnerabilities (elevation of privilege and spoofing) besides CVE-2026-70571. Microsoft recommends running the Exchange Server Health Checker after installation to verify the result.

Why it matters

This is the last security update released for Exchange 2016/2019. Microsoft states that support for Exchange 2016 and 2019 ended on 14 October 2025, that organizations enrolled in Period 2 ESU can receive updates until the end of October 2026, and that no updates will follow. Without ESU enrolment this patch is not offered to you; your server has been unpatched since October 2025. Even with ESU, there will be no patch for similar flaws from November 2026 on.

What to do now

1. Check your version and CU level: Review Get-ExchangeServer | Format-List Name,AdminDisplayVersion in the Exchange Management Shell and run Health Checker.
2. Install the KB above on all ESU-enrolled 2016/2019 and all SE servers. For 2016/2019 this is the last chance.
3. If you have no ESU: You cannot access the patch. Start the upgrade to Exchange SE or the move to Microsoft 365 / Exchange Online now.
4. Reduce risk until you migrate: Avoid exposing OWA and ECP directly to the internet where possible, restrict admin access, use MFA and monitor server logs. These do not replace the patch.

How can Doğa Network help?

Our team can help with in-place upgrades from Exchange 2019 CU14/CU15 to Exchange SE or migrations from Exchange 2016, moves to Microsoft 365 / Exchange Online, post-ESU licensing calculations (SA, CALs, Microsoft 365 plans) and the planned installation of this final update. For a free assessment, call us on +90 850 888 3642 or email hi@doga.network.

Sources

• MSRC – CVE-2026-70571
• Microsoft Support – Exchange SE, 13 October 2026 (KB5128895)
• Microsoft Support – Exchange 2019 CU15, 13 October 2026 (KB5128896)
• Microsoft Support – Exchange 2019 CU14, 13 October 2026 (KB5128897)
• Microsoft Support – Exchange 2016 CU23, 13 October 2026 (KB5128898)