We have fixed this in the May 2021 security updates and now admins can correctly validate the security patch status of servers. Prior to this release, the version information in the protocol response headers was incomplete and inaccurate.

In addition to the fixes for the vulnerabilities, we also fixed an issue with the version info that is returned in the protocol response headers. This can occur if the runspace is in no-language mode. Please see this KB article for more information.Īdditional fixes in May 2021 security update

After application of the Exchange Server April or May security updates, cmdlets executed against the Exchange Management Console using an invoked runspace might fail with the following error message: The syntax is not supported by this runspace.

Some cross-forest Free/Busy relationships based on Availability address space can stop working (depending on how authentication was configured) with the error: “The remote server returned an error: (400) Bad Request.” Please see this KB article for how to work around this problem.

The only workaround at this time is to rename Admin accounts or use accounts with no ‘$’ at the end of the name.

Administrator/Service accounts ending in ‘$’ cannot use the Exchange Management Shell or access ECP.

The following issues reported for April 2021 SUs also apply to May SUs and have the following workarounds: Known issues in May 2021 security updatesĭuring the release of April 2021 SUs, we received some reports of issues after installation. More details about specific CVEs can be found in Security Update Guide (filter on Exchange Server under Product Family). Exchange Online customers are already protected and do not need to take any action. These vulnerabilities affect on-premises Microsoft Exchange Server, including servers used by customers in Exchange Hybrid mode.

Although we are not aware of any active exploits in the wild, our recommendation is to install these updates immediately to protect your environment. The May 2021 security updates for Exchange Server address vulnerabilities responsibly reported by security partners and found through Microsoft’s internal processes. These updates are available for the following specific builds of Exchange Server: Microsoft has released security updates for vulnerabilities found in:

Polaris office 5 update