A security update rolled out in October 2026 broke Outlook authentication and email delivery for customers running Exchange Server on‑premises, highlighting operational hurdles for enterprises.

A Microsoft Windows Server patch released in October 2026 has unintentionally disabled Outlook authentication and halted mail flow for on‑premises Exchange Server deployments, forcing many enterprises into emergency work‑arounds.

What the patch changed

The October cumulative update for Windows Server 2022 introduced a security fix that altered the way Kerberos tickets are validated. Exchange Server, which relies on those tickets for Outlook Web Access and MAPI connections, began rejecting authentication attempts, causing users to see login failures and undelivered messages.

Immediate impact on businesses

Companies that have not yet migrated to Exchange Online experienced a sudden loss of access to internal email, disrupting daily operations and customer communications. IT teams reported increased ticket volumes as users struggled to send or receive mail.

Because the issue stems from a core Windows component, the problem persisted across different Exchange Server versions, from 2016 to the latest 2022 release.

Work‑arounds and fixes

Microsoft quickly issued a supplemental update that restores the previous authentication behavior. Administrators are advised to apply the follow‑up patch, temporarily revert to the prior cumulative update, or configure Kerberos constrained delegation as a stop‑gap.

  • Download the supplemental patch from the Microsoft Update Catalog
  • Re‑enable the previous cumulative update via Windows Server Update Services
  • Configure Kerberos constrained delegation for Exchange services

For organizations unable to apply the fix immediately, Microsoft recommends switching to Outlook on the web via HTTPS or using a VPN to route authentication through a separate domain controller.

The incident underscores the operational risks of maintaining on‑premises email infrastructure, especially when critical security updates intersect with legacy authentication mechanisms.

Related coverage: about the broader implications of on‑premises versus cloud email strategies on Infrastructure coverage at uxc.news and see how Microsoft is navigating these challenges on Microsoft on Momentum.

"We are actively working with customers to mitigate the impact and will provide additional guidance as needed," a Microsoft spokesperson said.

TechStartups coverage of Microsoft’s October patch issue