October 2026 Windows Server Updates Cause Exchange On-Premises Instability (EpmapSavedContextCap)

October 2026 Windows Server Updates Cause Exchange On-Premises Instability (EpmapSavedContextCap)

Last Updated: October 22, 2026
Applies To: On-premises Exchange Server 2016, 2019, and Subscription Edition (SE) running on Windows Server 2016, 2019, 2022, or 2025
Severity: High (intermittent to progressive service disruption on loaded servers)

Overview

The October 13, 2026 Windows Server cumulative updates introduced a new default limit in the RPC Endpoint Mapper service. This change was part of the security fix for CVE-2026-96300 (RPC Endpoint Mapper Service Denial of Service Vulnerability – uncontrolled resource consumption).

The default limit of 512 simultaneous Endpoint Lookup calls / saved contexts is insufficient for typical Exchange Server workloads. Exchange is heavily dependent on RPC for client access, transport, Information Store communication, and DAG replication. On busy servers the limit is often reached after roughly 12–24 hours of uptime, after which new RPC connections begin to fail.

Important: This issue is caused by the Windows Server updates, not by the October 2026 Exchange Server security updates. Microsoft strongly recommends keeping the Windows updates installed and applying the registry workaround below.

Affected Updates

 
Any version of Exchange Server (2016, 2019, or SE) running on these updated Windows Server versions can be affected. Impact severity depends on server load; some lightly loaded servers may never see the problem.

Symptoms

• Outlook on the web (OWA) fails with:
  MapiExceptionMdbOffline: Unable to make connection to the server. (hr=0x80004005, ec=1142)
• Event ID 1006 in the Application log
• Email queues grow; messages remain in the Outbox
• DAG members may have difficulty reaching quorum or replicating
• Temporary relief after a reboot (symptoms return as the limit is reached again)

Resolution / Workaround (Recommended by Microsoft)

!! Do not uninstall the October 2026 Windows Server updates !!

1. Open an elevated Command Prompt (admin) on each affected Exchange server.
2. Run the following command:

reg add "HKLM\SOFTWARE\Microsoft\Rpc" /v EpmapSavedContextCap /t REG_DWORD /d 65536 /f

3. Reboot the server.
4. Monitor mail flow, OWA, queues, and DAG health after the reboot.
5. If symptoms return (rare based on Microsoft’s reported cases), increase the value further and reboot again.

Notes

• You can create the registry value before installing the October updates; it is only read after the updates are present.
• To verify the setting after reboot:
  reg query “HKLM\SOFTWARE\Microsoft\Rpc” /v EpmapSavedContextCap
• Microsoft’s Exchange Support Team states this value has resolved the cases they have assisted with so far.
• A permanent fix is still under investigation by Microsoft (Windows and Exchange teams). There is no imminent follow-up release as of October 20–22, 2026.

Additional Recommendations

• Apply the registry change proactively on all Exchange servers that have (or will receive) the October 2026 Windows updates.
• In a DAG, reboot one member at a time and confirm quorum/health before proceeding to the next.
• Continue normal monitoring of Event ID 1006, queue length, and OWA connectivity.
• Keep the October Windows updates installed for their significant security content.

Official References

• Microsoft Exchange Team Blog: “Exchange servers may become unstable after installation of October 2026 Windows updates”
• Windows Release Health Dashboard (known issues for the affected Server versions)
• CVE-2026-96300 – RPC Endpoint Mapper Service Denial of Service Vulnerability

This article is based on Microsoft’s official guidance as of October 22, 2026. Always verify current status on the Microsoft Tech Community Exchange Blog and Windows Release Health Dashboard before applying changes in production.