"After installing the October 2026 Windows security update [..], some on-premises Exchange servers might experience issues accessing or sending email. Users might be unable to sign in to Outlook on the web (OWA), or email messages sent from Outlook might remain in the Outbox and not be delivered. Additionally, Exchange might experience issues accessing mailboxes during mailbox replication," Microsoft said at the time.
October 2026 Windows Server updates introduced an Endpoint Mapper memory limit
Microsoft acknowledged in mid-October that the October 2026 Windows Server security updates introduced a new default limit on the amount of memory Endpoint Mapper uses when handling Endpoint Lookup calls. Systems running Windows Server 2019 and later were specifically called out as the environments where customers reported problems after installing those updates.
How Exchange Server behavior changed: sign-ins, OWA and mail delivery
According to Microsoft’s bulletin, the new default limit could prevent users from signing in to Outlook on the web (OWA), leave messages stuck in Outlook’s Outbox, and cause Exchange to have trouble accessing mailboxes during mailbox replication. Microsoft emphasized variability in impact: "Not all Exchange servers will be impacted by installation of those updates equally; the severity and speed of impact varies based on Exchange server load. Some servers might never see a problem."
Microsoft also clarified that the OWA sign-in and mail flow problem was not related to the October 2026 Exchange server security updates and urged customers not to uninstall those Exchange updates.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleMicrosoft’s remediation: November Patch Tuesday updates KB5131080 and KB5131090
In an update to the Windows release health dashboard, Microsoft said the November 2026 Patch Tuesday cumulative updates—identified as KB5131080 and KB5131090—address the known Endpoint Mapper memory-limit issue. Microsoft advised affected customers to install those November updates on all impacted systems to restore normal Exchange sign-in and mail flow behavior.
Temporary workaround: a registry change and reboot
For organizations that could not immediately deploy the November cumulative updates, Microsoft provided a temporary workaround that increases the memory-capacity limit for Endpoint Mapper. Administrators are instructed to run the following command from an elevated Command Prompt on the Exchange Server, then restart the device:
reg add "HKLM\SOFTWARE\Microsoft\Rpc" /v EpmapSavedContextCap /t REG_DWORD /d 65536 /f
Microsoft’s guidance says the change increases the maximum number of Endpoint Lookup calls and the amount of memory Endpoint Mapper can use. After the server reboots, administrators should monitor the Exchange environment and raise the Endpoint Mapper memory limit further if problems recur.
What this means for IT administrators and Exchange users
- IT and Exchange administrators: The immediate, concrete actions are to deploy KB5131080 and KB5131090 where appropriate, or apply the registry workaround if patching is delayed. Administrators must watch Exchange server load and mailbox replication behavior after the change; Microsoft explicitly instructs teams to monitor and to raise the Endpoint Mapper memory limit again if the condition returns.
- Organizations and end users: End users who experienced inability to sign in to OWA or mail stuck in the Outbox should expect remediation once the November updates are applied or the registry workaround is implemented. Organizations should avoid uninstalling the October Exchange security updates, per Microsoft’s advisory, because those Exchange updates were not responsible for the new Endpoint Mapper limit.
The path to resolution is straightforward on paper: apply the November 2026 cumulative updates Microsoft identifies (KB5131080 and KB5131090) or enact the temporary registry change and reboot, then monitor systems. The company’s advisory leaves the operational follow-up to administrators — specifically, watching server load and raising the Endpoint Mapper memory cap if the issue returns.
Read the original Microsoft advisory and reporting at BleepingComputer: https://www.bleepingcomputer.com/news/microsoft/microsoft-fixes-exchange-sign-ins-broken-by-october-windows-server-updates/
