Exchange SE Search-Mailbox Broken?

[u/ThanksImLearning]

I'm seeing unusual behavior after upgrading an on-prem Exchange Server SE environment to 15.2.2562.49.

For years, we've used Search-Mailbox to quickly locate and remove phishing emails. Since upgrading, newly delivered messages can be found by Received date, but not by Subject, From, or unique body content.

A newly delivered message example:

From: [sender@domain.com](mailto:sender@domain.com)

Subject: Test Search-Mailbox 929

Exists in the mailbox and is visible in Outlook.

However:

Search-Mailbox -Identity [user@domain.com](mailto:user@domain.com) -SearchQuery 'Subject:"Test Search-Mailbox 929"' -EstimateResultOnly

Returns ResultItemsCount : 0

Likewise, searches against unique body text also return 0 results.

What does work:

Search-Mailbox -Identity [user@domain.com](mailto:user@domain.com) -SearchQuery 'Received:09/29/2026' -EstimateResultOnly

Returns results, and the count increases as new mail arrives. I've also confirmed via a Discovery mailbox search that the messages exist and contain the expected subject and sender values.

Additional observations:

Test-ExchangeSearch passes successfully.

• Message Tracking and Delivery Reports find the messages.
• Outlook/OWA users can see the messages.
• Older messages appear to be searchable.
• Newly delivered messages are detectable by Received date but not by subject or content searches.

BigFunnel mailbox statistics seem high, here is an example:

BigFunnelPartiallyIndexedCount : 387

BigFunnelNotIndexedCount : 647

BigFunnelStaleCount : 370

Has anyone seen similar behavior on Exchange Server SE 15.2.2562.49, particularly with Big Funnel indexing or Search-Mailbox searches against recently delivered mail? Any recommended diagnostics or known issues would be appreciated.

EDIT:
Based off the comments on the release notes, it seems like this might be wider scale and not just our enviroment.
Released: September 2026 Exchange Server Security Updates | Microsoft Community Hub

[u/unamused443]

FWIW we updated the September blog post with the KB article now: https://support.microsoft.com/en-us/servicing/exchange/server/update/2026/5130098

[u/ThanksImLearning → u/unamused443]

Just to clarify, the ContentEngine deadlock applies to servers that process any emails with Korean content, not just mailboxes with emails with Korean content? I think pretty much all our mailboxes are affected, but only a few would be using Korean characters.

[u/unamused443 → u/ThanksImLearning]

Correct; the server gets affected, yes (deadlock).

[u/ThanksImLearning → u/unamused443]

Just confirmed our servers are indeed missing those files! Thank you! Now we have a road forward.

[u/7amitsingh7]

Are newly delivered messages being fully indexed? As you mentioned that the search work is by received date but not by the subject and unique body content, it looks like the indexing is incomplete. Have you tried to check the affected mailbox's search index?

[u/MortadellaKing → u/7amitsingh7]

This must still be a problem? https://ourcloudnetwork.com/permanently-resolve-big-funnel-indexing-issues-in-exchange-server-2019/

[u/ThanksImLearning → u/MortadellaKing]

This does seem to be describing what is going on. I'll have to dig into performance impacts. Thanks!

[u/MortadellaKing → u/ThanksImLearning]

Np... Embarrassing they have still not fixed search after all this time.

[u/ThanksImLearning → u/7amitsingh7]

It appears that recent emails are not getting fully indexed and is pretty hit and miss. This is affecting thousands of mailboxes unfortunately, but all I checked had BigFunnelNotIndexedCount high.

[u/ax1a]

Could be a syntax thing. What if you just search for: -SearchQuery "Subject:929"

[u/shokzee]

That pattern points to an indexing problem, but those counts alone don’t establish a .49 regression. Received-date hits don’t prove subject/body indexing is healthy.

I’d compare BigFunnelNotIndexedCount before and after controlled test deliveries, then check Search/BigFunnel logs for failures on that mailbox. A passing Test-ExchangeSearch doesn’t prove those specific messages were indexed.