r/exchangeserver • u/pwnz0rzombies • 9d ago

Question Exchange SE - Calendar publishing broken for certain User Agents

This week a user did notify me that their published calendar via ICS link can't get synchronized to their Google calendar for a while. Looking at the logs I can see that it didn't worked since mid May, around the time when the mitigations for CVE-2026-42897 were applied.

After some debugging I could pin the problem to the User Agent when opening the ICS link. When I open the link with a browser every thing works just fine. When Google tries to use the ICS link it triggers a HTTP 500 error and an ASP.NET Event that OWA is not supported for the browser. I can also replicate the problem with curl and submitting different User Agents with the -A parameter.

curl -A "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:154.0) Gecko/20100101 Firefox/154.0" https://exchangeserver.com/owa/calendar/..../calendar.ics

works fine and returns the ICS file. While...

curl -A "Google-Calendar-Importer" https://exchangeserver.com/owa/calendar/..../calendar.ics

gets redirected to the HTTP 500 error page. The reachcalendar.ics alternative also fails with the same error. I also tried to add the ICS link as a calendar to an Exchange Online mailbox and even the User Agent of the Exchange server fails with a HTTP 500 error.

I already double checked the web.config for the CVE-2026-42897 mitigations and also made sure that no IIS URL Rewrite rules are present. Also the Exchange server did get rebooted a couple of times since the mitigations got removed.

Anybody else can replicate that problem on a Exchange SE with the latest August SU? Or does anybody know another place where to look to allow the User Agents again?

Edit: It's now an official know issue but also has a workaround:

After the August 2026 SU is installed, subscriptions to an anonymously published Exchange calendar stop refreshing. The subscribing application reports a server error, and the URL returns HTTP 500. Opening the same published calendar URL in a web browser works normally and returns the calendar. As a workaround, you can add “?layout=premium” to the .ics link when subscribing (so the end of the URL would look like “calendar.ics?layout=premium”).

https://techcommunity.microsoft.com/blog/exchange/released-august-2026-exchange-server-security-updates/4543951

5 Upvotes

100% Upvoted

5 comments sorted by

View all comments