Download Microsoft Exchange Server 2010 SP3 Rollup 19

Microsoft has already released the nineteenth Rollup for the third service pack of Exchange Server 2010. Service Pack 3 was released in February 2013. Mainstream support from Microsoft ended in January 2015, but extended support will run until January 2020. During this extended period, only security and time zone updates will be implemented. The corresponding KB article with number 4035162 reports that a vulnerability has been fixed that could occur in a coexistence environment of Exchange 2010 and Exchange 2016.

Update Rollup 19 for Exchange Server 2010 Service Pack 3

This cumulative update fixes the issue that is described in the following Microsoft Knowledge Base article:

• 4054456 EWS connections proxied from Exchange Server 2016 to 2010 can access all the Exchange 2010 mailboxes

Our deployment guidance states when these versions are deployed together, load balancer VIP’s can (should) be pointed to servers running Exchange Server 2016. Exchange Server 2016 will proxy calls to an appropriate server version based upon where the mailbox being accessed is located. We have become aware of a condition which could allow proxied EWS calls to gain access to mailboxes on the 2010 server to which a user should not have access. This issue, tracked by KB4054456, is resolved in Service Pack 3 Update Rollup 19 for Exchange Server 2010. Customers who have deployed Exchange Server 2010 and 2016 together are encouraged to apply Update Rollup 19 with high priority.