Microsoft has confirmed that this month's Windows Server security updates are causing OWA sign-in and mail delivery issues on some Exchange Server systems.
In a new Windows release health dashboard update over the weekend, Microsoft said users may have trouble accessing email or signing in to Outlook after installing the latest updates on systems running Windows Server 2019 and later.
In some cases, affected customers are also reportedly seeing Exchange Server OWA failing with a "MapiExceptionMdbOffline: Unable to make connection to the server. (hr=0x80004005, ec=1142)" error and Event ID 1006 in the application log.
"After installing the October 2026 Windows security update [..], some on-premises Exchange servers might experience issues accessing or sending email. Users might be unable to sign in to Outlook on the web (OWA), or email messages sent from Outlook might remain in the Outbox and not be delivered. Additionally, Exchange might experience issues accessing mailboxes during mailbox replication," it said.
"The October 2026 update introduced a default limit on the amount of memory used by Endpoint Mapper when handling Endpoint Lookup calls. For workloads such as Exchange Server, the default limit of 512 simultaneous Endpoint Lookup calls might not be sufficient under heavy load. Administrators can use this registry setting to increase the maximum number of simultaneous Endpoint Lookup calls, which increases the amount of memory that Endpoint Mapper can use."
However, Microsoft says these known issues aren't linked to the October 2026 Exchange server security updates and urges customers not to uninstall them.
"Issues reported are not related to installation of October 2026 security updates for Exchange Server. This is not a 'known issue' related to October 2026 Exchange update. Any version of Exchange that runs on impacted versions of Windows could be impacted," Microsoft added in a separate blog describing the issues.
"Not all Exchange servers will be impacted by installation of those updates equally; the severity and speed of impact varies based on Exchange server load. Some servers might never see a problem."
While it works on a fix, Microsoft also shared a temporary workaround that should resolve these issues by modifying a registry key on affected Exchange Server systems.
To do that, you have to run the following command from an elevated Command Prompt on the Exchange Server and then reboot the device:
reg add "HKLM\SOFTWARE\Microsoft\Rpc" /v EpmapSavedContextCap /t REG_DWORD /d 65536 /fAfter the system restarts, customers should monitor the Exchange environment and raise the Endpoint Mapper memory limit if it reoccurs.
In July. Microsoft also announced that it will stop shipping extended security updates for Exchange 2016 and 2019 this month after a 6-month extension announced in April 2026 to the original Extended Security Update (ESU) program.
Once attackers have valid credentials, only 37% of their actions are blocked
Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.
The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.