Description of the security update for Microsoft Exchange Server 2019 and 2016: August 8, 2023 (KB5029388)

NoticeWe have re-released the Exchange Server 2019 and 2016 August 8, 2023, security update (SU) to address the localization issue that caused installations on non-English operating systems (OS) to fail. You can find the re-released version of the SU here: <https://support.microsoft.com/help/5030524&gt;The SU will also soon be available through Microsoft Update / Windows Update. For more information about the re-release, see this Exchange Team Blog article.

Original article content

This security update rollup resolves vulnerabilities in Microsoft Exchange Server. To learn more about these vulnerabilities, see the following Common Vulnerabilities and Exposures (CVE)

• CVE-2023-21709 - Microsoft Exchange Server Elevation of Privilege Vulnerability

**Note:**Please follow the instructions in the Microsoft Security Response Center (MSRC) article to address the vulnerability.

• CVE-2023-38185 - Microsoft Exchange Server Remote Code Execution Vulnerability
• CVE-2023-35368 - Microsoft Exchange Server Remote Code Execution Vulnerability
• CVE-2023-38182 - Microsoft Exchange Server Remote Code Execution Vulnerability
• CVE-2023-35388 - Microsoft Exchange Server Remote Code Execution Vulnerability
• CVE-2023-38181 - Microsoft Exchange Server Spoofing Vulnerability

Issues that are fixed in this update

• DST settings are inaccurate after an OS update
• Microsoft Exchange replication service repeatedly stops responding
• Chinese coded characters aren’t supported in Exchange Admin Center
• External email address field doesn’t display the correct username

Features introduced in this update

• Enable support for AES256-CBC-encrypted content in Exchange Server August 2023 SU

Known issues in this update

• When you install this security update on a Windows-based server that is running a non-English operating system version, Setup suddenly stops and rolls back the changes. However, the Exchange Server services remain in a disabled state. For more information, see Exchange Server 2019 and 2016 August 2023 security update installation fails on non-English operating systems.
• Users in an account forest who install this security update might not be able to change their expired password by using Outlook on the web in an Exchange deployment in a multi-forest topology (Account-Resource or Resource-Resource). For more information, see Users in account forest can’t change expired password in OWA in multi-forest Exchange deployments after installing August 2023 SU.

Enabling Extended Protection in Exchange Server

To enable Extended Protection on Exchange-based servers, see Extended Protection enabled in Exchange Server (KB5017260).

How to get and install the update

This update is superseded by version 2 of the security update for Microsoft Exchange Server 2019 and 2016. For more information, see the “Known issues in this update” section in this article.

More information

Security update deployment information

For deployment information about this update, see Deployments - Security Update Guide.

Security update replacement information

This security update replaces the following previously released updates:

• Description of the security update for Microsoft Exchange Server 2019: June 13, 2023 (KB5026261)
• Description of the security update for Microsoft Exchange Server 2016: June 13, 2023 (KB5025903)

File information

File hash information

Update Name	File name		SHA256 hash
Exchange Server 2019 Cumulative Update 13 SU2	Exchange2019-KB5029388-x64-en.exe		AB47764A566A5555474BFF3AB3FDE03DC47C5E31B35B6BA196E25D9FBBD7DA48
Exchange Server 2019 Cumulative Update 12 SU9	Exchange2019-KB5029388-x64-en.exe		5539D00A4721AFF37AD804AA899B267D0F480039015745C15265D998D0338B18
Exchange Server 2016 Cumulative Update 23 SU9	Exchange2016-KB5029388-x64-en.exe		622C0D5441E1484A5FD5BE7438689E1D7722542A4B93ECF1A108214A9346C678

Hashes for additional languages

The hash tables for additional languages are available here:

• Hash tables for Exchange Server 2019 CU13 SU2 (KB5029388)
• Hash tables for Exchange Server 2019 CU12 SU9 (KB5029388)
• Hash tables for Exchange Server 2016 CU23 SU9 (KB5029388)

Information about protection and security

Protect yourself online: Windows Security supportLearn how we guard against cyber threats: Microsoft Security