Mondoo Vulnerability Intelligence
Search vulnerabilities and malicious packages across npm, PyPI, Go, GitHub Actions, VS Code, and more.
Search vulnerabilities and malicious packages across npm, PyPI, Go, GitHub Actions, VS Code, and more.
Description of the security update for Microsoft Exchange Server 2016 CU23: December 9, 2025 (KB5071873)
Applies To
Exchange Server 2016
This security update resolves vulnerabilities in Microsoft Exchange Server. To learn more about these vulnerabilities, see the following Common Vulnerabilities and Exposures (CVE):
CVE-2025-64666 - Microsoft Exchange Server Elevation of Privilege Vulnerability
CVE-2025-64667 - Microsoft Exchange Server Spoofing Vulnerability
Note: Please follow the instructions in the Microsoft Security Response Center (MSRC) article to address the vulnerability.
To verify that that the installation is successful, and check whether any additional actions are required, run the Exchange Server Exchange Server Health Checker.
To enable Extended Protection on Exchange-based servers, see Extended Protection enabled in Exchange Server (KB5017260).
Important:
Microsoft Exchange Server 2016 and 2019 have reached end of support. For more information, see Support for Exchange Server 2016 and Exchange Server 2019 ends.
Organizations enrolled in the Extended Security Update (ESU) program are eligible to receive the December 2025 security updates and all subsequent updates for Exchange Server 2016 and 2019.
To continue receiving the latest security updates, organizations not enrolled in the ESU program should migrate to Exchange Server Subscription Edition (SE).
If you have already purchased the ESU and require information on how to access the latest security updates, please email us at ExchangeandSfBServerESUInquiry@service.microsoft.com.
15.1.2507.6315.1.2507.6315.1.2507.6315.1.2507.6315.1.2507.6315.1.2507.6315.1.2507.6315.1.2507.6315.1.2507.6315.1.2507.6315.1.2507.6315.1.2507.6315.1.2507.6315.1.2507.6315.1.2507.6315.1.2507.6315.1.2507.63