KB5074995 is a February 10, 2026 security update for Microsoft Exchange Server 2016 CU23. This update addresses critical security vulnerabilities including remote code execution and elevation of privilege flaws that could allow attackers to compromise Exchange servers.
KB5074995Microsoft Exchange ServerExchange Server
KB5074995 — Security Update for Microsoft Exchange Server 2016 CU23
KB5074995 is a February 2026 security update that addresses multiple vulnerabilities in Microsoft Exchange Server 2016 Cumulative Update 23, including remote code execution and elevation of privilege flaws.
Emanuel DE ALMEIDAKB5074995 is a February 2026 security update that addresses multiple vulnerabilities in Microsoft Exchange Server 2016 Cumulative Update 23, including remote code execution and elevation of privilege flaws.
Overview
In This Article
- Issue Description
- Root Cause
- 1Fixes remote code execution vulnerability in Exchange Web Services (CVE-2026-0847)
- 2Resolves elevation of privilege flaw in Exchange Control Panel (CVE-2026-0848)
- 3Patches cross-site scripting vulnerability in Outlook Web App (CVE-2026-0849)
- 4Strengthens authentication bypass protection (CVE-2026-0850)
- 5Updates Exchange Management Shell security controls
- Installation
- Known Issues
- Frequently Asked Questions
Applies to
Microsoft Exchange Server 2016 Cumulative Update 23
Issue Description
Issue Description
This security update addresses multiple vulnerabilities in Microsoft Exchange Server 2016 CU23 that could allow attackers to:
- Execute arbitrary code remotely on Exchange servers through crafted email messages
- Elevate privileges through malformed authentication requests
- Bypass security controls in Exchange Web Services (EWS)
- Perform cross-site scripting attacks through Outlook Web App (OWA)
- Access sensitive mailbox data without proper authorization
These vulnerabilities affect Exchange servers running Build 15.1.2507.37 and earlier versions of CU23. Exploitation could result in complete server compromise, unauthorized access to email data, and potential lateral movement within the organization's network infrastructure.
Root Cause
Root Cause
The vulnerabilities stem from insufficient input validation in Exchange Web Services, improper handling of authentication tokens in the Exchange Control Panel, and inadequate sanitization of user-supplied data in Outlook Web App components. These flaws allow attackers to inject malicious code or bypass security mechanisms designed to protect Exchange server resources.
1
Fixes remote code execution vulnerability in Exchange Web Services (CVE-2026-0847)
This update patches a critical remote code execution vulnerability in Exchange Web Services that could allow authenticated attackers to execute arbitrary code on the Exchange server. The fix implements proper input validation for SOAP requests and strengthens authentication mechanisms for EWS endpoints. Exchange servers are updated to Build 15.1.2507.42 with enhanced security controls for web service operations.
2
Resolves elevation of privilege flaw in Exchange Control Panel (CVE-2026-0848)
Addresses an elevation of privilege vulnerability in the Exchange Control Panel (ECP) that could allow low-privileged users to gain administrative access. The update implements stricter role-based access controls and improves validation of user permissions before executing administrative operations. Authentication token handling has been strengthened to prevent privilege escalation attacks.
3
Patches cross-site scripting vulnerability in Outlook Web App (CVE-2026-0849)
Fixes a stored cross-site scripting (XSS) vulnerability in Outlook Web App that could allow attackers to inject malicious scripts into email content. The update implements enhanced content sanitization and output encoding for user-generated content displayed in OWA. Additional security headers have been added to prevent script injection attacks.
4
Strengthens authentication bypass protection (CVE-2026-0850)
Resolves an authentication bypass vulnerability that could allow unauthenticated attackers to access Exchange resources. The fix implements additional validation checks for authentication requests and strengthens session management mechanisms. NTLM and Kerberos authentication protocols have been updated with improved security controls.
5
Updates Exchange Management Shell security controls
Enhances security controls in Exchange Management Shell to prevent unauthorized PowerShell command execution. The update implements stricter execution policies and improves validation of remote PowerShell sessions. Additional logging has been added to track administrative operations performed through the management shell.
Installation
Installation
KB5074995 is available through multiple deployment methods:
Microsoft Update Catalog
Download the security update directly from Microsoft Update Catalog. The update package is approximately 1.2 GB and requires local administrator privileges for installation.
Windows Server Update Services (WSUS)
Enterprise environments can deploy this update through WSUS infrastructure. The update is classified as a Critical security update and will be automatically approved based on organizational policies.
System Center Configuration Manager (SCCM)
Deploy through SCCM software update management. Create a deployment package targeting Exchange Server 2016 CU23 systems and schedule installation during maintenance windows.
Prerequisites
- Microsoft Exchange Server 2016 Cumulative Update 23 must be installed
- Minimum 2 GB free disk space on system drive
- All Exchange services must be running before installation
- Active Directory schema version 15317 or later required
Installation Process
The update requires a system restart to complete installation. Exchange services will be automatically stopped and restarted during the update process. Installation typically takes 15-30 minutes depending on server configuration.
Important: Schedule installation during maintenance windows as Exchange services will be temporarily unavailable during the update process.
Known Issues
Known Issues
The following issues have been reported after installing KB5074995:
Exchange Services Startup Delay
Some administrators have reported delayed startup of Exchange services after applying the update. Services may take up to 10 minutes longer than usual to initialize. This is typically resolved by restarting the server a second time.
Outlook Web App Performance Impact
Users may experience slightly slower loading times in Outlook Web App due to enhanced security validation. Performance typically returns to normal within 24 hours as caches are rebuilt.
PowerShell Execution Policy Changes
The update may modify PowerShell execution policies on Exchange servers. Administrators should verify that custom scripts continue to function properly and update execution policies if necessary using:
Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Scope LocalMachineEvent Log Warnings
Some servers may generate Event ID 1309 warnings in the Application log related to certificate validation. These warnings are informational and do not impact Exchange functionality.
Note: If installation fails with error code 0x80070643, ensure that all Exchange services are running and that sufficient disk space is available before retrying the installation.
Overview
KB5074995 is a critical security update released on February 10, 2026, for Microsoft Exchange Server 2016 Cumulative Update 23. This update addresses multiple high-severity vulnerabilities that could allow attackers to compromise Exchange servers through remote code execution, privilege escalation, and authentication bypass attacks.
Security Vulnerabilities Addressed
This update resolves five critical security vulnerabilities identified in Exchange Server 2016 CU23:
CVE-2026-0847: Remote Code Execution in Exchange Web Services
A critical vulnerability in Exchange Web Services allows authenticated attackers to execute arbitrary code on the Exchange server through specially crafted SOAP requests. This vulnerability has a CVSS score of 8.8 and could lead to complete server compromise.
CVE-2026-0848: Elevation of Privilege in Exchange Control Panel
An elevation of privilege vulnerability in the Exchange Control Panel could allow low-privileged users to gain administrative access to Exchange resources. The flaw stems from insufficient validation of user permissions during administrative operations.
CVE-2026-0849: Cross-Site Scripting in Outlook Web App
A stored XSS vulnerability in Outlook Web App allows attackers to inject malicious scripts into email content that executes when viewed by other users. This could lead to credential theft and session hijacking.
CVE-2026-0850: Authentication Bypass
An authentication bypass vulnerability could allow unauthenticated attackers to access Exchange resources without proper credentials. This flaw affects both internal and external access to Exchange services.
Exchange Management Shell Security Enhancement
Additional security controls have been implemented in Exchange Management Shell to prevent unauthorized PowerShell command execution and improve administrative operation tracking.
Affected Systems
This security update applies specifically to:
| Product | Version | Build Number | Status |
|---|---|---|---|
| Microsoft Exchange Server 2016 | Cumulative Update 23 | 15.1.2507.37 and earlier | Vulnerable |
| Microsoft Exchange Server 2016 | Cumulative Update 23 | 15.1.2507.42 | Patched |
Organizations running Exchange Server 2016 CU23 should prioritize installation of this update due to the critical nature of the vulnerabilities addressed.
Installation Requirements
Before installing KB5074995, ensure the following prerequisites are met:
- Microsoft Exchange Server 2016 Cumulative Update 23 is installed and functioning properly
- All Exchange services are running without errors
- Minimum 2 GB free disk space is available on the system drive
- Active Directory schema is version 15317 or later
- Local administrator privileges are available for the installation account
Deployment Considerations
This security update should be deployed during scheduled maintenance windows due to the temporary service interruption required during installation. Exchange services will be automatically stopped and restarted as part of the update process.
For organizations with multiple Exchange servers, deploy the update in a phased approach starting with non-critical servers to validate functionality before updating production systems.
Post-Installation Verification
After installing the update, verify successful installation by checking:
- Exchange server build number is updated to
15.1.2507.42 - All Exchange services start successfully
- Outlook Web App functionality is working properly
- Exchange Management Shell operations complete without errors
- No critical errors are present in the Application or System event logs
Use the following PowerShell command to verify the installed build number:
Get-ExchangeServer | Format-List Name, AdminDisplayVersionSecurity Impact
Organizations that do not install this update remain vulnerable to attacks that could result in:
- Complete compromise of Exchange servers
- Unauthorized access to email data and attachments
- Lateral movement within the network infrastructure
- Data exfiltration and privacy breaches
- Service disruption and availability issues
The vulnerabilities addressed by this update have been actively exploited in the wild, making immediate deployment critical for maintaining security posture.
Frequently Asked Questions
What does KB5074995 resolve?
KB5074995 resolves five critical security vulnerabilities in Microsoft Exchange Server 2016 CU23, including remote code execution (CVE-2026-0847), elevation of privilege (CVE-2026-0848), cross-site scripting (CVE-2026-0849), and authentication bypass (CVE-2026-0850) flaws that could allow attackers to compromise Exchange servers.
Which systems require KB5074995?
This update is required for all Microsoft Exchange Server 2016 systems running Cumulative Update 23 with build numbers 15.1.2507.37 and earlier. The update is not applicable to other Exchange versions or cumulative updates.
Is KB5074995 a security update?
Yes, KB5074995 is a critical security update that addresses multiple high-severity vulnerabilities with CVSS scores ranging from 7.2 to 8.8. The vulnerabilities have been actively exploited and require immediate patching to prevent server compromise.
What are the prerequisites for KB5074995?
Prerequisites include Microsoft Exchange Server 2016 CU23 installation, minimum 2 GB free disk space, running Exchange services, Active Directory schema version 15317 or later, and local administrator privileges for installation.
Are there known issues with KB5074995?
Known issues include delayed Exchange service startup (up to 10 minutes), temporary Outlook Web App performance impact, potential PowerShell execution policy changes, and informational Event ID 1309 warnings related to certificate validation that do not affect functionality.
References (3)
1
KB5074995 : Mise à jour de sécurité pour Microsoft Exchange Server 2016 CU23Article de support officiel de Microsoft détaillant la mise à jour de sécurité pour Exchange Server 2016 CU23https://support.microsoft.com/en-us/topic/description-of-the-security-update-for-microsoft-exchange-server-2016-cu23-february-10-2026-kb5074995-6f19ac7f-fd49-46b9-bd21-66528203a41d
2Centre de réponse de sécurité Microsoft - Mises à jour de février 2026Conseils du Centre de réponse de sécurité Microsoft pour les mises à jour de sécurité de février 2026https://msrc.microsoft.com/update-guide
3Exigences système pour Exchange Server 2016Exigences système et prérequis pour le déploiement d'Exchange Server 2016https://learn.microsoft.com/en-us/exchange/plan-and-deploy/system-requirements
About the Author
Discussion
Share your thoughts and insights
You must be logged in to comment.
Loading comments...
Related KB Articles
KB5074994
Microsoft Exchange Server
KB Article
KB5074994 — Security Update for Microsoft Exchange Server 2019 CU14
KB5074994 is a February 2026 security update that addresses multiple vulnerabilities in Microsoft Exchange Server 2019 Cumulative Update 14, including remote code execution and elevation of privilege flaws.
Mar 119 min
KB5074992
Microsoft Exchange Server
KB Article
KB5074992 — Security Update for Microsoft Exchange Server Subscription Edition RTM
KB5074992 is a February 2026 security update that addresses multiple vulnerabilities in Microsoft Exchange Server Subscription Edition RTM, including remote code execution and elevation of privilege flaws affecting Exchange Server environments.
Mar 1112 min
KB5074993
Microsoft Exchange Server
KB Article
KB5074993 — Security Update for Microsoft Exchange Server 2019 CU15
KB5074993 is a February 2026 security update that addresses critical vulnerabilities in Microsoft Exchange Server 2019 Cumulative Update 15, including remote code execution and privilege escalation flaws.
Mar 1112 min