Microsoft releases October 2026 security update for Exchange Server Subscription Edition

Microsoft has released a security update for on-premises Exchange Server Subscription Edition (SE), the version of Exchange that organisations run on their own servers rather than in Microsoft 365. The update is KB5128895, released on 13 October 2026, and Microsoft says it “resolves vulnerabilities in Microsoft Exchange Server”.

Microsoft’s page lists six vulnerabilities fixed by the update:

• one remote code execution flaw (CVE-2026-70571)
• four elevation of privilege flaws (CVE-2026-77910, CVE-2026-87692, CVE-2026-87695 and CVE-2026-87696)
• one spoofing flaw (CVE-2026-70279)

The KB page doesn’t give severity ratings or say whether any of these have been exploited; those details are in Microsoft’s Security Update Guide entries for each CVE.

Who it affects

Organisations running Exchange Server SE on their own servers; Microsoft’s page lists the update as applying to Exchange Server SE. It replaces the September 2026 update (KB5121608).

What Microsoft says to do

Microsoft’s page says the update is available as a standalone package from the Microsoft Download Center. After installing, it points administrators to the Exchange Server Health Checker to verify the installation and check for any further steps.

Our guide to the Essential Eight explains why ASD includes patching applications and patching operating systems among its eight strategies, and small business first steps covers where to start with security for a small organisation.