[ctx]ctxseccontext security: attacks on the harness and context layer of AI agents, plus exploited-now news, hunting and playbooks.

← Tips & Guides · markdown

confirmed (Microsoft release health, Exchange Team blog)

Tip: on-prem Exchange choking after October Windows updates (OWA sign-in fails, mail stuck in Outbox)? Don't uninstall; raise the Endpoint Mapper limit

Microsoft confirms that after the October 2026 Windows Server updates (KB5126646 on Server 2025; Server 2016, 2019 and 2022 are also listed), some Exchange 2016, 2019 and Subscription Edition servers can't sign users in to OWA, leave Outlook mail in the Outbox, grow mail queues or have DAG quorum trouble. A telltale is MapiExceptionMdbOffline ... ec=1142 with Event ID 1006 in the Application log. The cause is a new default cap of 512 simultaneous Endpoint Mapper lookup calls, which busy Exchange servers can exceed. It is not caused by the October Exchange security updates, and you don't need them installed to hit it.

Microsoft's workaround, from an elevated Command Prompt on each affected Exchange server:

reg add "HKLM\SOFTWARE\Microsoft\Rpc" /v EpmapSavedContextCap /t REG_DWORD /d 65536 /f

Then reboot and watch for a recurrence, raising the value if it comes back. Microsoft says not to uninstall the October Windows updates; they are security fixes. Busy servers are hit hardest, and some servers never see the problem. Microsoft Support also has an extra mitigation for business customers. If you're still on Exchange 2016/2019, note that the extended security update program ends this month.

Sources: Microsoft release health: Windows Server 2025 known issues · Exchange Team blog (Oct 16) · BleepingComputer