Microsoft has confirmed that the October 2026 Windows Server cumulative updates are causing significant disruptions for Exchange Server environments, including mail delivery failures and Outlook Web Access (OWA) sign-in issues. The problem is linked to a new security hardening measure that limits the number of simultaneous calls the Remote Procedure Call (RPC) Endpoint Mapper can handle.
The disruption affects multiple versions of Windows Server. Administrators managing Exchange on the following updates should monitor for instability:
- Windows Server 2025: KB5126646
- Windows Server 2022: KB5126655
- Windows Server 2019: KB5126651
- Windows Server 2016: KB5126868
The Root Cause: RPC Endpoint Exhaustion
The instability is not caused by the Exchange-specific security patches, but rather by the underlying Windows Server cumulative updates. These updates introduced a default limit of 512 simultaneous Endpoint Lookup calls for the RPC Endpoint Mapper.
In high-load environments or systems with high internal RPC traffic, this limit is quickly reached. When the cap is hit, the RPC service begins dropping calls, which manifests as database offline errors and service timeouts. Exchange administrators have reported that these issues typically do not appear immediately after patching. Instead, systems often remain stable for approximately 20 to 24 hours after a reboot before the RPC endpoint exhaustion triggers the service failure.
Common indicators of this issue in server logs include:
- Error code:
MapiExceptionMdbOffline - Specific error constant:
ec=1142 - Event ID:
1006
Official Workaround and Registry Fix
Microsoft has advised against uninstalling the October security updates, as doing so would leave servers vulnerable to other patched security flaws. Instead, the company recommends a specific registry modification to increase the RPC call limit and restore mail flow.
To resolve the issue, administrators must manually create a registry value to override the new 512-call default. The recommended value is 65536, which provides a significantly higher ceiling for RPC lookups.
Mitigation Steps:
1. Open the Registry Editor (regedit.exe) on the affected Windows Server.
2. Navigate to the following path: HKLM\SOFTWARE\Microsoft\Rpc
3. Create a new REG_DWORD value named EpmapSavedContextCap.
4. Set the Data value to 65536 (Decimal).
5. Restart the server for the changes to take effect.
While this workaround addresses the immediate “MapiExceptionMdbOffline” errors, Microsoft continues to investigate the impact of the hardening measure.
Security teams should apply the registry fix immediately if they observe mail flow delays or OWA authentication failures following the October update cycle. Monitoring should continue for at least 48 hours post-fix to ensure the 24-hour exhaustion window has passed without further incident.
