As reported by BleepingComputer, Microsoft has resolved a significant known issue introduced by the October 2026 Windows Server security updates that broke Outlook on the Web (OWA) sign-ins and disrupted mail delivery on on-premises Exchange Server systems. The fix arrives via the November 2026 Patch Tuesday cumulative updates, KB5131080 and KB5131090.

Security Impact: As reported by BleepingComputer, Microsoft has resolved a significant known issue introduced by the October 2026 Windows Server security updates that broke Outlook on the Web (OWA) sign-ins and disrupted mail delivery on on-premises Exchange Server systems.

What Happened and Why It Matters

The October updates introduced a new default memory cap on the RPC Endpoint Mapper as a security hardening measure. While the intent was to reduce the attack surface of RPC-based services—a legitimate concern given the history of RPC vulnerabilities—the tightened limit had an unintended side effect: Exchange Server's high-volume RPC call patterns exhausted the allocated memory, causing authentication failures, stuck messages in Outboxes, and mailbox replication errors.

This is a textbook example of the tension between security hardening and operational availability. The patch was designed to protect, but it degraded one of the most business-critical services organizations run on-premises.

Microsoft noted that impact varied by server load—lightly loaded Exchange servers may have never experienced symptoms, making the issue harder to detect in test environments before production deployment. This load-dependent failure mode is particularly insidious because staging and QA environments typically don't replicate production traffic levels.

Affected Systems

AttributeDetail
Affected OSWindows Server 2019 and later
Affected WorkloadOn-premises Exchange Server (all supported versions)
Root CauseEndpoint Mapper memory cap introduced in October 2026 updates
Fixing UpdatesKB5131080, KB5131090 (November 2026 Patch Tuesday)
SeverityHigh (service disruption, no data loss reported)
Active ExploitationNo—this is a functional regression, not a security vulnerability

Broader Implications for Patch Management

This incident underscores a persistent challenge for on-premises Exchange administrators: security updates for the underlying OS can break the application layer in ways that vendor test matrices don't always catch. Exchange's deep dependency on Windows RPC infrastructure makes it especially sensitive to kernel-level changes.

For organizations still running on-prem Exchange, this is yet another argument for accelerating migration to Exchange Online or hybrid configurations—though we recognize that regulatory, sovereignty, and cost factors often make that impractical in the near term.

Shield53 Recommendations

Broader Implications for Patch Management
Deploy November updates immediately on all affected Exchange servers. KB5131080 and KB5131090 resolve the Endpoint Mapper memory regression.
If you cannot patch right away, apply the registry workaround on affected servers:
reg add "HKLM\SOFTWARE\Microsoft\Rpc" /v EpmapSavedContextCap /t REG_DWORD /d 65536 /f
Then reboot the server. Monitor for recurrence and increase the value if symptoms return.
Validate staging environments against production-equivalent load profiles. Load-dependent failures like this one will not surface in under-provisioned test labs.
Review your patch delay policy. If you deferred October updates due to this known issue, confirm you aren't also missing critical security fixes addressed in those same patches. The November cumulative updates supersede October's, closing that gap.
Monitor Exchange transport health post-patch using Get-Queue, Get-ServerHealth, and event log IDs 1009/1014 to confirm mail flow restoration.
Document the workaround in your runbook. Microsoft has a track record of RPC-related regressions, and similar issues may recur in future update cycles.

For on-prem Exchange shops, this is a reminder that the operating system and the application are tightly coupled in ways that cloud-hosted email simply doesn't experience. Until migration is on the table, rigorous patch testing under realistic load remains your best defense against update-induced outages.