KB5071873: This security update resolves vulnerabilities in Microsoft Exchange Server

Description of the security update for Microsoft Exchange Server 2016 CU23: December 9, 2025 (KB5071873)

Original article content
This security update resolves vulnerabilities in Microsoft Exchange Server. To learn more about these vulnerabilities, see the following Common Vulnerabilities and Exposures (CVE):

• CVE-2025-64666 - Microsoft Exchange Server Elevation of Privilege Vulnerability
• CVE-2025-64667​​​​​​​ - Microsoft Exchange Server Spoofing Vulnerability​​​​​​​​​​​​​​

Note: Please follow the instructions in the Microsoft Security Response Center (MSRC) article to address the vulnerability.

Exchange Server Health Checker
To verify that that the installation is successful, and check whether any additional actions are required, run the Exchange Server Exchange Server Health Checker.

Enabling Extended Protection in Exchange Server
To enable Extended Protection on Exchange-based servers, see Extended Protection enabled in Exchange Server (KB5017260).