KB5066369

Description of the security update for Microsoft Exchange Server 2016 CU23: October 14, 2025 (KB5066369)

Applies To

Exchange Server 2016

Original article content

This security update rollup resolves vulnerabilities in Microsoft Exchange Server. To learn more about these vulnerabilities, see the following Common Vulnerabilities and Exposures (CVE)

• CVE-2025-59249 - Microsoft Exchange Server Elevation of Privilege Vulnerability

• CVE-2025-53782 - Microsoft Exchange Server Elevation of Privilege Vulnerability

• CVE-2025-59248 - Microsoft Exchange Server Spoofing Vulnerability

Note: Please follow the instructions in the Microsoft Security Response Center (MSRC) article to address the vulnerability.

Issues that are fixed in this update

• Auth Certificate export through Exchange cmdlet is no longer supported

Exchange Server Health Checker

To verify that that the installation is successful, and check whether any additional actions are required, run the Exchange Server Exchange Server Health Checker.

Enabling Extended Protection in Exchange Server

To enable Extended Protection on Exchange-based servers, see Extended Protection enabled in Exchange Server (KB5017260).

How to get and install the update

Microsoft Download Center

You can get the standalone update package through the Microsoft Download Center.

• Microsoft Exchange Server 2016 Cumulative Update 23 SU19- Download the package now