October 2026 Windows Server Updates Break Exchange OWA Sign-In and Mail Flow: What Admins Need to Know

Microsoft Confirms Exchange Issues Linked to October Windows Server Updates

Microsoft has confirmed that the October 2026 Windows Server security updates can cause Outlook on the web (OWA) sign-in failures and mail delivery issues on some on-premises Exchange Server systems.

Importantly, the problem comes from the Windows Server updates themselves, not from the October 2026 Exchange Server security updates. Admins troubleshooting broken mail flow should look at the operating system patches rather than the Exchange patches.

Which Updates and Versions Are Affected

The problematic updates are the October 13, 2026 cumulative updates for Windows Server:

• KB5126646 – Windows Server 2025 (build 26100.33650)
• KB5126655 – Windows Server 2022 (build 20348.5761)
• KB5126651 – Windows Server 2019 (build 17763.9376)
• KB5126868 – Windows Server 2016 (build 14393.9612)

Affected Exchange versions include Exchange Server 2016, Exchange Server 2019, and Exchange Server SE. Microsoft notes that any Exchange version running on an impacted Windows version could be affected.

Symptoms and Error Messages

Administrators and users may encounter several symptoms on affected servers:

• Users may be unable to sign in to Outlook on the web (OWA).
• Messages sent from Outlook may remain stuck in the Outbox.
• Mailboxes may be difficult to access during mailbox replication.

OWA may also fail with the following error:

• MapiExceptionMdbOffline: Unable to make connection to the server. (hr=0x80004005, ec=1142)

This error may be accompanied by Event ID 1006 in the Application log, which can help admins confirm they are dealing with this particular issue.

Why It Happens: The New RPC Endpoint Mapper Limit

The RPC Endpoint Mapper listens on port 135 and tells RPC clients which port to use to reach a given service. Exchange relies heavily on RPC, which makes it particularly sensitive to changes in how the Endpoint Mapper behaves.

The October updates introduce a new default limit on the memory the RPC Endpoint Mapper uses when handling Endpoint Lookup calls. That default caps the service at 512 simultaneous Endpoint Lookup calls, which may be insufficient for workloads like Exchange Server under heavy load.

Load-Dependent and Delayed Failures

Because the issue is tied to the number of simultaneous Endpoint Lookup calls, its impact depends on how heavily each Exchange server is loaded. Some servers may never experience a problem at all.

Admins should also be aware that failures may not appear immediately after a reboot. Instead, problems can surface after some time has passed, which can make it harder to connect the symptoms to the recently installed updates.

Workaround and Microsoft's Guidance

Microsoft says administrators can use a registry setting to raise the maximum number of simultaneous Endpoint Lookup calls, which also increases the amount of memory the Endpoint Mapper can use. This workaround is intended for use while Microsoft develops a fix.

Microsoft also urges customers not to uninstall the October 2026 Exchange Server security updates, since they are not the cause of these problems.

For the exact registry key and value to apply, administrators should consult Microsoft's official guidance before making changes to production Exchange servers.