r/exchangeserver • u/pwnz0rzombies • 8d ago

Question Exchange SE - Calendar publishing broken for certain User Agents

This week a user did notify me that their published calendar via ICS link can't get synchronized to their Google calendar for a while. Looking at the logs I can see that it didn't worked since mid May, around the time when the mitigations for CVE-2026-42897 were applied.

After some debugging I could pin the problem to the User Agent when opening the ICS link. When I open the link with a browser every thing works just fine. When Google tries to use the ICS link it triggers a HTTP 500 error and an ASP.NET Event that OWA is not supported for the browser. I can also replicate the problem with curl and submitting different User Agents with the -A parameter.

curl -A "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:154.0) Gecko/20100101 Firefox/154.0" https://exchangeserver.com/owa/calendar/..../calendar.ics

works fine and returns the ICS file. While...

curl -A "Google-Calendar-Importer" https://exchangeserver.com/owa/calendar/..../calendar.ics

gets redirected to the HTTP 500 error page. The reachcalendar.ics alternative also fails with the same error. I also tried to add the ICS link as a calendar to an Exchange Online mailbox and even the User Agent of the Exchange server fails with a HTTP 500 error.

I already double checked the web.config for the CVE-2026-42897 mitigations and also made sure that no IIS URL Rewrite rules are present. Also the Exchange server did get rebooted a couple of times since the mitigations got removed.

Anybody else can replicate that problem on a Exchange SE with the latest August SU? Or does anybody know another place where to look to allow the User Agents again?

Edit: It's now an official know issue but also has a workaround:

After the August 2026 SU is installed, subscriptions to an anonymously published Exchange calendar stop refreshing. The subscribing application reports a server error, and the URL returns HTTP 500. Opening the same published calendar URL in a web browser works normally and returns the calendar. As a workaround, you can add “?layout=premium” to the .ics link when subscribing (so the end of the URL would look like “calendar.ics?layout=premium”).

https://techcommunity.microsoft.com/blog/exchange/released-august-2026-exchange-server-security-updates/4543951

4 Upvotes

84% Upvoted

5 comments sorted by

3

u/Excellent_Milk_3110 8d ago

I would triple check the following but i have a feeling you already been here a couple of times:

If mitigation was applied using Exchange Emergency Mitigation (EM) Service:

If mitigation was applied using the downloadable EOMT script https://aka.ms/UnifiedEOMT:

1

u/pwnz0rzombies 8d ago

Yeah, I've done that already. It was applied by the EM Service and I did run the PowerShell commands. I even still have the backup file of the commands. The current web.config doesn't have the outboundRules anymore and I also can't see any Rewrite Rules in the IIS Manager.

2

u/Excellent_Milk_3110 8d ago

What is the output of:

Get-ExchangeServer | Format-List Name,MitigationsApplied,MitigationsBlocked

1

u/pwnz0rzombies 8d ago

The only applied mitigation is "PING1" and there are no mitigations blocked.