Microsoft confirmed on 16 October that October Windows Server security updates can make on-premises Exchange unstable. Outlook on the web may refuse sign-in, and mail can sit in the Outbox. This is a Windows update problem, not a reason to roll back the Exchange security update.
What happened
The Exchange team said the failures started after the 13 October Windows Server updates. The October Windows update adds a default cap of 512 simultaneous Endpoint Lookup calls in Endpoint Mapper. Under load, that cap is not enough for Exchange.
Reported symptoms include OWA failing with MapiExceptionMdbOffline (hr=0x80004005, ec=1142) and Event ID 1006 in the Application log, growing mail queues, and Database Availability Group members failing to reach quorum. A reboot can clear it for a while, then it returns. Microsoft says the October Exchange security updates are not the cause, and not every server will hit it. Impact depends on load.
Who is affected
Any Exchange version running on an affected Windows Server build can be hit, including Exchange Server 2016, Exchange Server 2019, and Exchange Subscription Edition.
- Windows Server 2025: KB5126646
- Windows Server 2022: KB5126655
- Windows Server 2019: KB5126651
- Windows Server 2016: KB5126868
What to do now
Do not uninstall the October Windows updates. Apply Microsoft's registry workaround, reboot, and watch the queues.
- From an elevated Command Prompt on the Exchange server, run: reg add "HKLM\SOFTWARE\Microsoft\Rpc" /v EpmapSavedContextCap /t REG_DWORD /d 65536 /f
- Reboot the server.
- Watch OWA sign-in, transport queues, and DAG quorum. If the fault returns, raise the limit further. Microsoft Support has an extra mitigation if this is not enough.
- Leave the October Exchange security updates installed. Microsoft says they are not the cause.
What this means for South African businesses
A lot of South African SMEs still run Exchange on a local Windows Server, often patched by an MSP over a weekend. The failure is load-dependent, so a quiet test after patching can look fine and the outage shows up on Monday morning, when staff cannot reach webmail and invoices sit in the Outbox. Treat a growing queue or Event ID 1006 after this month's Windows update as this fault, not as a new malware incident, and fix the cap before you start an incident call.
Source: Microsoft Exchange Team, 16 October 2026.
Also on the blog
Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.