EWS connections proxied from Exchange Server 2016 to 2010 can access all Exchange Server 2010 mailboxes

Applies to: Exchange Server 2010 Service Pack 3

Symptoms


In a Microsoft Exchange Server 2010 and Exchange Server 2016 coexistence environment, when EWS connections are proxied from Exchange Server 2016 to Exchange Server 2010, all mailboxes of Exchange Server 2010 can be accessed without any permission.

Cause


This issue occurs because authentication isn't handled correctly by Exchange Front-End servers.

Resolution


To fix this issue, apply Update Rollup 19 for Exchange Server 2010 Service Pack 3.

Status


Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section.

References


Learn about the terminology that Microsoft uses to describe software updates.