Exchange Server CVE-2026-116928: Patch Windows Search Now

Published 14 November 2026 · Rathish Kumar, Invitty

Microsoft's 10 November 2026 updates fix CVE-2026-116928, a Critical (CVSS 9.8) flaw in Windows Search that an attacker can trigger on an Exchange server just by emailing a crafted attachment, because Exchange indexes it automatically. Patch Windows Server with the November cumulative update and install the Exchange SE security update KB5133453. Exchange 2016 and 2019 receive no fix at all.

What changed on 10 November

Most coverage of this month's Patch Tuesday went to the Outlook zero-day, which we wrote about on 11 November. For anyone still running mail on their own servers, the more serious item is a Windows bug, not an Exchange one. Microsoft's advisory for CVE-2026-116928 describes an out-of-bounds write in the Windows Search component. Its FAQ spells out the Exchange angle: an unauthenticated sender mails a booby-trapped attachment, Exchange hands it to Windows Search for indexing, and the code runs with the rights of that processing service. Nobody has to open the message.

That is why the score is 9.8. No login, no user click, reachable over the network. Microsoft lists it as not exploited and not publicly disclosed as of release day. In our experience that status can change within weeks once researchers start comparing the patched and unpatched files, so we would not plan around it.

The same release carries nine Exchange Server CVEs of its own. The worst, CVE-2026-118207, is a Critical remote code execution bug rated 8.8 that needs an attacker with a low-privilege account on the server. The rest are elevation of privilege, spoofing and denial of service issues rated between 6.5 and 8.8. None is marked as exploited.

Which servers need which update?

Two separate packages are involved, and patching only one leaves the door open. The Windows Search fix ships in the Windows cumulative update; the Exchange fixes ship in the Exchange security update (SU). The Exchange team's 10 November post also says the order in which you install them does not matter.

Two points from the Exchange team's notes are worth acting on. First, the SU goes on every Exchange server, including management-only boxes and admin workstations with the Exchange Management Tools. Second, if your servers became unstable after the October 2026 Windows updates, the fix is the November Windows Server update itself. The registry workaround Microsoft gave for October can stay in place but is no longer needed.

What if we are still on Exchange 2016 or 2019?

This is the part we keep having to explain to customers. Microsoft says the Period 2 Extended Security Update programme for Exchange 2016 and 2019 has ended, and that these versions are no longer tested for vulnerabilities or patched. The November Windows update still closes the Windows Search hole underneath them, so install it. Every future Exchange bug, though, stays open on those servers for good.

If you are on 2019 today, our honest view is that the clock has run out. You have two real paths:

• Stay on-premises with Exchange SE. The licensing terms require the SE server and CALs to be subscription licences or to carry active Software Assurance. Old perpetual CALs on their own do not qualify. Users licensed for Exchange Online Plan 1 or 2 count as CAL equivalents, which helps if you are already part-way into Microsoft 365.
• Move mailboxes to Exchange Online. Microsoft states that Exchange Online is already protected against this month's issues. A hybrid setup still keeps at least one on-premises server, and that server needs the SU like any other.

Which one is right depends on mailbox count, archive size, compliance needs and how many line-of-business apps relay mail through the server. For most 30 to 300 user offices we work with, the move to Microsoft 365 wins on cost once you add up server hardware renewal, SE subscriptions and the admin time each monthly SU takes.

What to do this week, in order

1. Inventory. List every server with the Exchange role or tools installed, its Windows Server version and its Exchange build. Microsoft's Exchange Server Health Checker script reports patch status per server.
2. Install the November Windows cumulative update on all of them, including Exchange 2016 and 2019 boxes. This is the one that closes CVE-2026-116928.
3. Install KB5133453 on every Exchange SE server and management workstation, then reboot and confirm all Exchange services started. Disabled services usually mean the setup was interrupted.
4. Hybrid customers: if the auth certificate changed after the SU, re-run the Hybrid Configuration Wizard.
5. Check inbound mail filtering. A gateway that strips or sandboxes unusual attachment types reduces what reaches the indexer in the first place. It does not replace the patch.
6. Decide on 2016 and 2019. Put a date on SE licensing or migration in this quarter's plan, not next year's.

What it means for budgets and compliance in India

Exchange is often the oldest server in an Indian SMB's rack, bought on a perpetual licence years ago and never budgeted again. SE turns that into a recurring subscription, so finance teams should see it as an operating cost line, billed through a licensing partner with a GST invoice, rather than a one-time purchase.

On the security side, a mail server compromise is the kind of incident CERT-In's April 2022 directions expect to be reported within six hours of noticing it. Running a version the vendor itself calls permanently vulnerable makes that conversation harder with auditors and cyber insurers. If you keep any on-premises mail, pair it with a proper email security gateway and log retention you can actually search.

Questions admins are asking about the November Exchange update

Next step

Send us your Exchange version, Windows Server version and mailbox count. We will confirm which November updates each server needs, and if you are on 2016 or 2019, give you a side-by-side quote for Exchange SE licences and an email migration to Microsoft 365. Licence renewals and true-ups are handled through our renewals desk.

Sources

Facts in this post come from these pages, checked on 14 November 2026. Advisories and update notes change, so check the source before you schedule work.

• Microsoft Security Update Guide: CVE-2026-116928, Windows Search Remote Code Execution Vulnerability
• Microsoft Security Update Guide: CVE-2026-118207, Microsoft Exchange Server Remote Code Execution Vulnerability
• Microsoft Exchange Team: Released, November 2026 Exchange Server Security Updates
• Microsoft Product Terms: Exchange Server (Microsoft Customer Agreement)
• CERT-In directions under section 70B(6) of the IT Act, 28 April 2022 (six-hour incident reporting)