"After installing the October 2026 Windows security update [..], some on-premises Exchange servers might experience issues accessing or sending email," Microsoft warned, noting that "Users might be unable to sign in to Outlook on the web (OWA), or email messages sent from Outlook might remain in the Outbox and not be delivered."
Microsoft advisory and scope of impact
Microsoft confirmed that this month's Windows Server security updates are responsible for OWA sign-in failures and mail delivery problems on some Exchange Server systems. The company emphasized that the problems are not related to October 2026 security updates for Exchange Server itself and called this a Windows-related issue: "Any version of Exchange that runs on impacted versions of Windows could be impacted." Microsoft also said the issue is not a "known issue" tied to the October Exchange update. The company is working on a fix and published guidance in a blog post describing the problem and mitigation steps.
Technical cause: Endpoint Mapper memory limit
Microsoft traced the disruption to a change introduced by the October 2026 update that sets a default limit on Endpoint Mapper memory usage when handling Endpoint Lookup calls. The update imposes a default limit of 512 simultaneous Endpoint Lookup calls; for heavy workloads such as Exchange Server, that default "might not be sufficient under heavy load." Microsoft noted administrators can use a registry setting to increase the maximum number of simultaneous Endpoint Lookup calls, which increases the amount of memory Endpoint Mapper can use.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildObserved symptoms and error indicators
Customers have reported a set of distinct symptoms on affected systems. Web access failures present as an inability to sign in to Outlook on the web (OWA). Mail clients may leave messages stuck in the Outbox so they are not delivered. In some cases Exchange OWA fails with the error "MapiExceptionMdbOffline: Unable to make connection to the server. (hr=0x80004005, ec=1142)" and administrators will see Event ID 1006 in the application log. Microsoft warned that not all Exchange servers will be impacted equally: "the severity and speed of impact varies based on Exchange server load. Some servers might never see a problem."
Temporary workaround: registry change and reboot
While a permanent patch is in development, Microsoft published a temporary workaround that raises the Endpoint Mapper memory limit via the registry. Administrators should run the following command from an elevated Command Prompt on the affected Exchange server and then reboot the device:
reg add "HKLM\SOFTWARE\Microsoft\Rpc" /v EpmapSavedContextCap /t REG_DWORD /d 65536 /f
After the system restarts, Microsoft advised monitoring the Exchange environment and raising the Endpoint Mapper memory limit again if the issue recurs.
How technologists, administrators, and affected enterprises are responding
- Technologists and security teams: The incident highlights an operational blind spot Microsoft flagged elsewhere in its reporting: "Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply." The Blue Report 2026 — cited by Microsoft — measures defenses technique by technique across 338 million simulations, a reminder that operational monitoring remains critical while patches and workarounds are applied.
- IT administrators and operations teams: Teams are expected to apply the registry workaround on impacted servers, reboot those systems, and monitor mail flow and OWA responsiveness. Because impact depends on server load, operators will need to prioritize systems under the heaviest load and watch application logs for Event ID 1006 and the MapiExceptionMdbOffline error.
- Affected enterprises and procurement leaders: Organizations running older Exchange deployments also face a parallel calendar pressure: in July Microsoft announced it will stop shipping extended security updates for Exchange 2016 and 2019 this month, following a six-month extension announced in April 2026. That timetable may affect decisions about upgrade and mitigation resources while this Windows update issue is resolved.
Microsoft is working on a fix and has provided an explicit, actionable mitigation. For now the practical path is clear: identify Exchange servers running on the updated Windows builds, apply the registry change where required, reboot, and watch for the specific error signatures and Event ID 1006. The combination of a targeted registry workaround and monitoring is the immediate remedy; whether the forthcoming fix will change the recommended default or how broadly Microsoft will alter the update remains to be published by the company.
