Exchange Server CVE-2026-70571 unauthenticated RCE via crafted email (October 2026 Patch Tuesday, Exploitation More Likely): which update fixes it?

What it is: a stack-based buffer overflow in Exchange Server's content conversion. An unauthenticated attacker can send a crafted email and run code on the server, with no user interaction. Microsoft fixed it on October 13, 2026 (October Patch Tuesday), rated it Critical (CVSS 8.1) and marked it 'Exploitation More Likely'. As of October 25 it was not listed as exploited, but mail servers are reachable by anyone who can send them email, so patch quickly. Am I affected? On-premises Exchange Server Subscription Edition (SE), Exchange 2019 CU14/CU15 and Exchange 2016 CU23 without the October 2026 security update. Exchange Online is patched by Microsoft. How to check: run the Exchange HealthChecker script (from Microsoft's CSS-Exchange GitHub repo) on each server, or compare the build number (Get-ExchangeServer | Format-List Name,AdminDisplayVersion, plus the installed updates) with the October 2026 build listed in Microsoft's KB articles. Fix: install the October 2026 Exchange Server security update for your version (KB5128895 to KB5128898; pick the one for your SE/CU level). If you are on an older CU, update to a supported CU first, because security updates only ship for supported CUs. The same update also fixes other Exchange CVEs from this release, such as CVE-2026-77910 and CVE-2026-87692. Interim mitigation (no substitute for patching): keep Exchange behind an inbound mail filter or gateway, make sure the Exchange Emergency Mitigation service is enabled, and avoid exposing Exchange directly to the internet beyond what mail flow and client access require. After patching: rerun HealthChecker to confirm the build on every server (including DAG members and Edge Transport), and review servers for unexpected new files in web folders, new scheduled tasks or services, and unusual child processes of Exchange worker processes. Sources: https://www.tenable.com/cve/CVE-2026-70571 https://support.microsoft.com/help/5128896 https://www.crowdstrike.com/en-us/blog/patch-tuesday-analysis-october-2026/ https://www.action1.com/vulnerabilities/cve-2026-70571/