October Windows Updates Break Exchange Mail Flow

October Windows Server updates break Exchange sign-in and mail flow

If you run Exchange Server on-premises, this is the item to act on first. Microsoft has confirmed that the October Windows updates can break Exchange Server email services, including sign-in and mail flow. BleepingComputer and Cyber Security News both reported the issue on October 19, pointing specifically at the Windows Server updates.

This is a reliability problem, not a vulnerability, but it lands in the same decision you make every patch cycle: deploy now or hold. The hard part is that the October rollups also carry Critical fixes. The Windows Server 2025 update KB5126646 covers 1041 CVEs, Windows Server 2022 KB5126655 covers 977, and the Windows 10 rollups KB5126651 and KB5126657 cover 918 and 899 respectively, all flagged as containing KEV-listed content. You cannot simply skip them. Test against a representative Exchange host, watch for the sign-in and mail flow symptoms Microsoft described, and stage deployment to your mail servers deliberately.

Separately, Microsoft fixed game and app crashes tied to the KB5124010 preview update, so if you pushed that one and saw crashes, the fix is out.

Exploited CVEs still demanding attention

No new CISA KEV additions came through for this date, but the active exploitation list has not cooled. Ivanti Connect Secure authentication bypass by spoofing, CVE-2026-104935 (CVSS 8.6, KEV-listed), sits at the top of the hot movers. Internet-facing VPN gateways are a favorite target, so treat this as patch now.

Several KEV entries are also ransomware-linked, which is the line between patch eventually and patch now. JetBrains TeamCity deserialization CVE-2026-63077 (CVSS 9.8, EPSS 0.90), Oracle PeopleSoft PeopleTools CVE-2026-35273 (CVSS 9.8, EPSS 0.97), and WebPros cPanel and WHM CVE-2026-41940 (CVSS 9.8, EPSS 0.99) all carry a ransomware association on top of KEV status. Older but still exploited entries round out the list: ProFTPD CVE-2015-3306, Apache Struts CVE-2016-3081, ISC BIND CVE-2015-5477, and Cisco Secure Email Gateway path traversal CVE-2026-76519.

Rapid7 also published analysis on October 19 of the critical BeyondTrust Remote Support authentication bypass CVE-2026-102764 being exploited in the wild, alongside CVE-2026-1731. If you use BeyondTrust Remote Support, confirm your patch state.

Identity and supply chain pressure on Microsoft 365

Two items hit Microsoft 365 operators directly. ConnectWise suspended its Cloud Backup service after attackers abused its Microsoft 365 access, with Help Net Security and Dark Reading both noting downstream risk for MSPs and their customers. If ConnectWise Cloud Backup touched your tenant, review what access it held and look for anomalous activity.

Phishing continues to lean on the Microsoft brand. Help Net Security reports Microsoft is the most impersonated brand in phishing, ahead of Apple and Google. Cyber Security News also flagged attackers registering new Teams-based domains with fake login pages to harvest credentials. Reinforce phishing-resistant authentication and watch for lookalike Teams domains.

Do this first

A short, grounded list for today:

• Test the October Windows Server updates against an Exchange host before broad deployment, watching for sign-in and mail flow failures (A12, A1).
• Patch Ivanti Connect Secure for CVE-2026-104935; it is KEV-listed and your VPN edge is exposed.
• Prioritize the ransomware-linked KEV entries: TeamCity CVE-2026-63077, PeopleSoft CVE-2026-35273, and cPanel CVE-2026-41940.
• Audit any ConnectWise Cloud Backup access into your Microsoft 365 tenant and review for abuse (A9, A10).
• Use the free Senserva Microsoft Patch Tracker to rank your open Microsoft patches by KEV, EPSS, and ransomware linkage so Exchange hosts and KEV content get the right attention.

Sources

• Cyber Security News: Microsoft Confirms October Windows Updates Can Break Exchange Server Email Services (2026-10-19)
• BleepingComputer: Microsoft: October Windows Server updates break Exchange sign-in, mail flow (2026-10-19)
• BleepingComputer: Microsoft fixes game, app crashes caused by recent Windows update (2026-10-19)
• Rapid7: CVE-2026-102764: Critical BeyondTrust Remote Support Authentication Bypass Exploited in the Wild (2026-10-19)
• Help Net Security: ConnectWise suspends Cloud Backup service after attackers abuse its Microsoft 365 access (2026-10-19)
• Dark Reading: ConnectWise Disables Cloud Backups Amid Concerns for Downstream MSPs (2026-10-19)
• Help Net Security: Cybercriminals favor Microsoft over Apple and Google in brand phishing attacks (2026-10-19)
• Cyber Security News: Hackers Registered New Teams-Based Domains and Used a Login Page to Steal Your Logins (2026-10-19)

Written by Senserva Trustworthy AI from the day's live partner feeds (CISA KEV, MSRC, FIRST EPSS, and the trusted press list), validated so every CVE, KB, and reference resolves to that data. The sources behind every feed, and their terms, are on our Data sources & thanks page. Facts as of 2026-10-20.

Senserva is a Microsoft security company and a member of the Microsoft Intelligent Security Association. Senserva audits your Microsoft 365, Intune, Defender, and Entra ID environment: complete patch state, 650+ security checks, and full reports, with clear guidance on what to fix first.