On 14 July 2026, Microsoft released critical security updates addressing
CVE-2026-55008, a severe Microsoft Exchange Server spoofing vulnerability scored 9.6 under CVSS 3.1, affecting Exchange Server 2016 CU23, Exchange Server 2019 CU14 and CU15, and Exchange Server Subscription Edition RTM
. If your Kent or South East business runs on-premises Exchange Server, this update requires immediate attention.
The July 2026 Exchange security release is substantial,
with Microsoft patching 622 vulnerabilities across its products this month, including 57 marked as “critical”, and noting that two of the vulnerabilities disclosed this month have been exploited in the wild
.
Understanding CVE-2026-55008: The Critical Exchange Vulnerability
The vulnerability is caused by improper neutralization of input during web page generation—the underlying class of flaw commonly known as cross-site scripting, or XSS. An unauthenticated attacker can conduct spoofing over a network; the CVSS vector specifies low attack complexity and no required privileges, but it also requires user interaction
.
What makes this particularly dangerous is the potential impact.
Successful exploitation could let an attacker cause Exchange-hosted content to appear trustworthy or execute attacker-controlled script in the victim’s browser context, depending on the vulnerable web path and the user’s interaction. Microsoft’s vector assigns high confidentiality, integrity, and availability impact after compromise because the scope can extend beyond the vulnerable component
.
In practical terms, this means an attacker could craft malicious emails that, when accessed through Outlook on the web, could appear legitimate whilst executing harmful code in an employee’s browser session—potentially harvesting credentials, accessing sensitive email data, or spreading laterally through your organisation.
July 2026 Exchange Updates Address Multiple Critical Flaws
CVE-2026-55008 isn’t the only concern in this release.
Microsoft’s July 14 Exchange Server security releases also address CVE-2026-55005, a remote code execution vulnerability; CVE-2026-55006, an elevation-of-privilege flaw; and CVE-2026-55009, another elevation-of-privilege issue
.
Even if an organisation assesses the spoofing scenario as requiring too much user interaction to be an immediate crisis, delaying the Exchange update leaves the same server exposed to other July vulnerabilities with different attack preconditions
. This bundled risk significantly elevates the operational priority for UK businesses.
The timing is particularly significant given recent trends. As we covered in our analysis of Business Email Compromise attacks costing UK SMEs £700,000 in single payments, email security vulnerabilities represent one of the costliest threat vectors facing businesses today.
Which Exchange Server Versions Are Affected?
The Exchange product group released the July 2026 updates for Exchange Server SE, as well as Exchange 2019 and 2016. The Security Update for Exchange SE is available to the public. Security updates for Exchange 2019 and Exchange 2016 are available to organisations enrolled in the Extended Security Update Period 2 programme
.
If you’re running Exchange Server 2016 or 2019, these versions reached end of support before this July release cycle. You’ll need to be enrolled in the Period 2 Extended Security Update (ESU) programme to receive these critical patches.
Affected Exchange Server versions
- Microsoft Exchange Server Subscription Edition RTM
- Exchange Server 2019 Cumulative Update 14 (CU14)
- Exchange Server 2019 Cumulative Update 15 (CU15)
- Exchange Server 2016 Cumulative Update 23 (CU23) – ESU Period 2 required
Immediate Actions for UK SMEs Running Exchange Server
Administrators should treat the July 2026 Exchange security updates as a near-term deployment priority, particularly for internet-facing Outlook on the web environments
.
Step 1: Identify your Exchange Server version
You need to establish which version and cumulative update your organisation is currently running. You can check this through the Exchange Admin Centre or via PowerShell in the Exchange Management Shell. If you’re uncertain about your current version, contact your IT support provider immediately.
Step 2: Download the appropriate security update
Microsoft has published specific security update packages for each affected version.
Security Updates have been released for Exchange Server SE, with Exchange Server 2019 and 2016 ESU updates only
.
Step 3: Test in a non-production environment
Wherever possible, test the security update in a staging or test environment before deploying to production.
Be aware of the following issue after installing these SU: Wrapper messages appear in shared mailbox in hybrid environments after installing the June 2026 Security Update
. Document your Exchange configuration and take appropriate backups.
Step 4: Apply the update during a maintenance window
Schedule a maintenance window to apply the update. Exchange security updates are cumulative, so you only need to install the latest update for your specific Cumulative Update version. Allow sufficient time for the installation and post-installation verification.
Step 5: Remove CVE-2026-42897 mitigations if applicable
If your organisation previously applied mitigations for CVE-2026-42897 (a vulnerability disclosed in May 2026),
you may remove implemented mitigations for CVE-2026-42897. These mitigations could be deployed using Exchange Emergency Mitigation Service (EMS), or manually using the EOMT.ps1 script. If you used EMS, block the mitigation (M2.1.0) from re-applying, then remove its IIS rules
.
What If You Can’t Patch Immediately?
CISA’s Stakeholder-Specific Vulnerability Categorization data, as reflected in the NVD record on July 15, reports exploitation as “none” and automation as “no.” Those are the best currently available indicators that there is no confirmed widespread exploitation or turnkey automated attack path. They are not a reason to defer the update, particularly because Exchange remains an unusually valuable target
.
If immediate patching isn’t operationally feasible, consider these interim measures:
- Review and strengthen monitoring of Outlook on the web (OWA) access logs
- Implement additional web application firewall rules if available
- Restrict OWA access to known IP ranges where practical
- Increase user awareness training about suspicious emails and web content
- Enable multi-factor authentication on all email accounts—a control we’ve previously covered in our supply chain cyber security guidance
However, these are temporary mitigations only. The vulnerability requires patching to fully remediate.
The Broader Context: July 2026’s Record Patch Volume
This Exchange vulnerability sits within an unprecedented month for Microsoft security updates.
Microsoft’s July 2026 Patch Tuesday is, by a significant margin, the largest single-month security release in the company’s history. The Zero Day Initiative counted 621 new Microsoft CVEs for the month, and the year-to-date total already exceeds every other full-year total in the last two decades
.
For UK SMEs, this volume presents both a challenge and a clear signal: the threat landscape is intensifying, and proactive patch management is no longer optional. As we examined in our article on Windows 11 July 2026 security updates, organisations must develop systematic approaches to security update deployment.
Migration Considerations for End-of-Life Exchange Servers
If you’re running Exchange Server 2016 or 2019 without ESU Period 2 coverage, this vulnerability underscores the urgency of migration planning. You have three primary options:
Migrate to Exchange Server Subscription Edition
Exchange Server SE represents Microsoft’s current on-premises offering, with ongoing security updates and feature development. This path maintains your on-premises control whilst ensuring continued support.
Migrate to Microsoft 365
Exchange Online customers are already protected from the vulnerabilities addressed by these SUs and do not need to take any action other than updating any Exchange servers or Exchange Management tools workstations in their environment
. Cloud migration eliminates the patching burden entirely, though it requires careful planning around regulatory requirements, connectivity, and hybrid scenarios.
Implement a hybrid approach
Many UK organisations benefit from a phased hybrid deployment, maintaining critical on-premises infrastructure whilst moving appropriate workloads to the cloud. This requires careful security architecture but can offer the best of both models.
Whichever path you choose, delaying the decision whilst running unsupported Exchange versions exposes your business to exactly the kind of critical vulnerabilities we’re seeing in July 2026.
Why Email Security Remains a Priority Investment
Exchange Server vulnerabilities matter because email remains central to business operations—and central to attacker objectives. Recent research shows that
phishing remains the dominant attack vector, implicated in 83% of incidents
, whilst
43% of UK businesses, roughly 612,000 organisations, identified a cyber breach or attack in the previous 12 months
.
The convergence of these statistics with critical Exchange vulnerabilities creates significant risk. An unpatched Exchange server provides attackers with a privileged entry point into an organisation’s most sensitive communications infrastructure.
This aligns with emerging regulatory pressure too. The
UK Cyber Security and Resilience Bill passed all House of Commons stages and entered the House of Lords on 25 June 2026—the most significant expansion of the UK’s cyber regulation framework since NIS 2018. With Royal Assent expected by late 2026 and phased enforcement through 2028, every UK SME and MSP now has a closing window to achieve Cyber Essentials certification, implement the CAF controls, and build the evidence base regulators will demand
.
Expert IT Support for Exchange Security in Kent
If your organisation runs Exchange Server and you’re uncertain about your current patch status, affected versions, or migration options, professional guidance is essential. Unpatched Exchange servers represent one of the highest-risk security exposures for UK businesses in July 2026.
Meridian Micro Limited provides comprehensive IT support services for businesses across Kent and the South East, including Exchange Server management, security patch deployment, and cloud migration planning. Our team maintains deep expertise in Microsoft infrastructure, ensuring your email systems remain secure, compliant, and operationally resilient.
Don’t wait for an exploit to force your hand. Contact our team today on 01303 883111 to discuss your Exchange Server security, assess your current patch status, and develop a comprehensive plan that protects your business whilst supporting your operational requirements.