Back Feeds.4Sysops

Exchange Server August 2026 update disables OWA Light and fixes Pwn2Own bug

Feeds.4Sysops •IT News • August 12, 2026

Microsoft’s August 2026 Exchange Server security update permanently disables OWA Light and addresses an authentication-bypass vulnerability that security researchers demonstrated at Pwn2Own. The release also determines whether Exchange Server 2016 and 2019 customers can continue receiving updates: only organizations enrolled in Period 2 Extended Security Updates are eligible. Source

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Exchange Server August 2026 Update Disables OWA Light and Addresses Vulnerabilities Microsoft's August 2026 Exchange Server security update permanently disables the OWA Light client across all servers. This update addresses an authentication-bypass vulnerability demonstrated at Pwn2Own, affecting Exchange Server 2016 and 2019. Organizations must be enrolled in Period 2 Extended Security Updates to continue receiving updates. Additionally, the update exposes a hybrid-deployment issue impacting messages from shared mailboxes, requiring administrators to conduct post-update checks. The vulnerabilities could potentially allow unauthorized access to sensitive information if not addressed. The update is critical for maintaining security in affected systems, and organizations are urged to apply it promptly. 2 sources 71

Exchange Server August 2026 update disables OWA Light and fixes Pwn2Own bug

The full story

Extracted Entities

CWE Weaknesses (1)

Platforms (1)