October Windows Server updates break Exchange sign-in and mail flow: Microsoft advises holding deployment
Microsoft has formally confirmed that the October 2025 Windows Server security updates are causing Outlook Web App (OWA) sign-in failures and disrupting mail delivery on some Exchange Server installations, according to BleepingComputer. The affected patches are KB5066198 (Windows Server 2025) and KB5066193 (Windows Server 2022). For on-premises Exchange operations teams, this is a deployment decision that needs immediate attention — particularly for those who have not yet pushed the update into production.
Scope: partial impact, two symptom classes
Microsoft has documented the problem in its support documentation. Based on publicly available information, some Exchange Server environments are affected; this is not a universal impact. Two symptom classes are known:
- OWA sign-in failure — after submitting valid credentials, users are redirected back to the sign-in page or shown an error, and cannot complete authentication through the web front end.
- Mail-flow disruption — the Transport service is unable to process messages properly, resulting in delivery delays or a full stoppage.
Both symptoms can occur simultaneously, and this is a critical distinction. An OWA outage alone is, at worst, a user-complaint incident. Once the Transport layer is also affected, however, the situation escalates into a genuine service-availability incident, with an immediate rise in the risk of external outages.
Affected KBs: KB5066198 and KB5066193
BleepingComputer's report identifies two affected Windows Server updates: KB5066198 for Windows Server 2025 and KB5066193 for Windows Server 2022. However, Microsoft has not published a complete compatibility matrix of Windows Server versions against Exchange Cumulative Updates. In other words, information on which combinations are affected remains at the level of "some environments are impacted." The correct course of action for administrators is:
- Inventory every Exchange host in the environment to determine its current Cumulative Update version and whether KB5066198 or KB5066193 has been applied.
- Cross-reference against the latest wording on Microsoft's official support page before taking action; that page is the sole authoritative source.
In environments with DAG, Edge Transport, or mixed standalone deployments, this inventory must cover every node — spot-checking a single host is not sufficient.
Microsoft's guidance: uninstall the affected updates
Microsoft's current recommendation is direct and unambiguous: on hosts running Exchange Server, uninstall KB5066198 or KB5066193 until a corrective update ships. The uninstall can be carried out with standard Windows Server servicing tooling, but the actual cost depends on when the update was installed and whether other patches were bundled alongside it — co-removing other updates is a possible side effect. After rollback, administrators will need to reassess which security fixes have been removed along with the target patch.
Exchange Online and hybrid deployments: the source is silent
It is worth noting that BleepingComputer's report focuses on on-premises Exchange Server and does not explicitly address impact on Exchange Online or hybrid (hybrid) scenarios. We will not speculate on Microsoft's position here. The operational judgement is as follows: pure Exchange Online tenants are not affected by this Windows Server update cycle (as no local servers are running); hybrid environments, however, must verify the update status of every on-premises node, because problems at the local layer will drag down overall mail flow.
Deployment hold: the security trade-off
For teams that have not yet deployed the October updates, holding is the prudent course. One caveat, however: holding the update also means holding this month's security fixes. The following checklist is recommended:
- Hold deployment — disable Windows Server automatic updates on Exchange Server hosts, specifically excluding KB5066198 and KB5066193, until Microsoft publishes a corrective release.
- Inventory affected hosts — confirm the current Cumulative Update version on every Exchange Server and which October KBs have been installed.
- Baseline mail flow — verify that the Transport Queue is draining and that OWA is accessible from multiple clients before making further changes.
- Validate in a staging environment first — if a staging environment is available, install the update there and verify sign-in and send/receive before pushing to production.
- Track the official fix and assess the security gap — monitor Microsoft's support page for the corrective KB; in parallel, evaluate the risk of deferring this month's security patches and, where necessary, apply compensating controls such as endpoint detection and network segmentation to close the gap.
Microsoft has not yet announced a release date for the corrective update. Until then, the recommendation for Exchange administrators is straightforward: hold deployment, and complete the host inventory first.
10 月 Windows Server 更新導致 Exchange 登入及郵件流動中斷：Microsoft 建議暫緩部署
Microsoft 已正式確認，2025 年 10 月 Windows Server 安全更新會令部分 Exchange Server 安裝出現 Outlook Web App（OWA）登入失敗，並影響郵件遞送，據 BleepingComputer 報導。受影響更新為 KB5066198（Windows Server 2025） 及 KB5066193（Windows Server 2022）。對本機 Exchange 維運團隊而言，這是一個需要即時處理的部署決定——尤其適用於尚未將更新推送至生產環境的團隊。
影響範圍：部分環境受影響，症狀分為兩類
Microsoft 已在官方支援文件記錄問題。根據現時公開資料，受影響的是部分 Exchange Server 環境，並非全面波及。已知症狀有兩類：
- OWA 登入失敗——用戶提交正確的登入密碼後被重新導向至登入頁，或顯示錯誤訊息，無法通過 Web 前端完成認證。
- 郵件流動中斷——Transport 服務無法正常處理郵件，導致遞送延遲或全面停擺。
兩類症狀可以同時出現，這一點相當關鍵。單是 OWA 中斷，最嚴重也只是用戶投訴事件；但一旦 Transport 層亦受影響，事態便會升級為真正的服務可用性事故，對外服務中斷的風險即時上升。
受影響 KB：KB5066198 及 KB5066193
BleepingComputer 的報導指出兩個受影響的 Windows Server 更新：針對 Windows Server 2025 的 KB5066198，以及針對 Windows Server 2022 的 KB5066193。然而，Microsoft 尚未公佈 Windows Server 版本與 Exchange Cumulative Update 的完整相容性矩陣。換言之，關於哪些組合受影響，現階段資訊仍停留在「部分環境受影響」的層面。管理員的正確做法是：
- 盤點環境內每部 Exchange 主機現時的 Cumulative Update 版本，以及是否已套用 KB5066198 或 KB5066193。
- 行動前對照 Microsoft 官方支援頁的最新表述；該頁面為唯一權威來源。
在設有 DAG、Edge Transport 或混合獨立伺服器部署的環境中，此項盤點必須涵蓋全部節點——只抽查單一主機並不足夠。
Microsoft 指引：卸載受影響更新
Microsoft 現時的建議直接而明確：在執行 Exchange Server 的主機上，卸載 KB5066198 或 KB5066193，直至修正更新發佈。卸載可使用標準 Windows Server servicing 工具執行，但實際成本視乎更新何時安裝，以及是否有其他修補一併捆綁——其他更新有可能被一併移除。回滾後，管理員需要重新評估有哪些安全修補隨目標更新一同被移除。
Exchange Online 及混合部署影響：來源未有交代
值得留意的是，BleepingComputer 的報導重點為本機 Exchange Server，並未明確交代 Exchange Online 或混合（hybrid）場景所受的影響。我們不會在此推斷 Microsoft 的立場。操作層面的判斷如下：純 Exchange Online 租用戶不會受今次 Windows Server 更新周期影響（因沒有本機伺服器運行）；混合環境則必須核實每一個本機節點的更新狀態，因為本機層面出現問題同樣會拖累整體郵件流動。
暫緩部署：安全修補的取捨
對尚未部署 10 月更新的團隊而言，暫緩是穩妥的做法。但須留意一點：暫緩更新，亦意味著本月的安全修補一併延遲。以下為建議的操作清單：
- 暫緩部署——在 Exchange Server 主機上停用 Windows Server 自動更新，特別排除 KB5066198 及 KB5066193，直至 Microsoft 公佈修正版本。
- 盤點受影響主機——確認每部 Exchange Server 現時的 Cumulative Update 版本，以及已安裝哪些 10 月 KB。
- 建立郵件流動基線——確認 Transport Queue 正在正常排空，且 OWA 可由多個用戶端正常存取，然後才進行其他變更。
- 先於 Staging 環境驗證——如有 Staging 環境，先在該處安裝更新，並驗證登入及收發正常後，再推送至生產環境。
- 追蹤官方修正並評估安全缺口——留意 Microsoft 支援頁何時發佈修正 KB；同時評估延遲本月安全修補的風險，必要時以端點偵測、網絡分段等緩解措施補足安全缺口。
Microsoft 尚未公佈修正更新的發佈日期。在此之前，建議 Exchange 管理員採取「暫緩部署、先完成主機盤點」的原則處理。