Skip to main content
CybersecurityVulnerability Management

Microsoft Ends Exchange 2016, 2019 Security Updates in October

Server room with technicians in background and blank screen in foreground.

"There will be no further extension of Exchange 2016/2019 ESU program timeline. Once October 2026 ends, there will be no further updates for Exchange 2016/2019, even if you currently have a Period 2 ESU," the Exchange Server said in a Monday blog post.

Microsoft's timeline and the end of the ESU program

Microsoft reminded customers that it will stop shipping security updates for Exchange Server 2016 and 2019 through the Extended Security Update (ESU) program in October 2026. The company had granted a six-month extension in April 2026 to the original ESU program; that original program began in October after Exchange Server 2016 and 2019 reached the end of their mainstream support windows.

Exchange 2016 reached mainstream support end in October 2020, and Exchange 2019's mainstream support ended in January 2024. Microsoft says the current Period 2 ESU is now roughly at its midpoint and that it will not be extended beyond the October 2026 cutoff.

How Microsoft is advising IT admins to respond

Microsoft's guidance to administrators is direct: upgrade or migrate. The company advised IT admins to move to Exchange Server Subscription Edition (SE). According to Microsoft's guidance, admins can perform in-place upgrades from Exchange Server 2019 to Exchange Server SE using a process identical to installing a Cumulative Update (CU).

For administrators who still operate Exchange 2016 or 2013 in production, Microsoft advised two routes: either directly upgrade to Exchange Server SE, or first install Exchange 2019 and then move to SE. The vendor also points administrators to detailed Microsoft 365 migration guidance available on Microsoft's documentation site.

Migration routes: Exchange Server SE, Exchange 2019 and Exchange Online

Microsoft highlights three concrete migration pathways in its public guidance. First, an in-place upgrade from Exchange Server 2019 to Exchange Server SE is presented as straightforward and CU-like. Second, organizations running Exchange 2016 or 2013 are told they may upgrade directly to Exchange Server SE or stage an upgrade by installing Exchange 2019 first. Third, Microsoft provides guidance on how to migrate to Exchange Online, which it notes is available either as a standalone service or as part of an Office 365 subscription.

Related Microsoft support moves for Windows and servers

The Exchange ESU deadline is one element of a broader set of Microsoft support decisions this year. In June, Microsoft quietly extended the free Windows 10 Extended Security Updates (ESU) program for consumers by an additional year, allowing enrolled devices to continue receiving security updates up until October 2027. Separately, the company announced earlier this month that Windows Server 2022 and Windows 11 24H2 Home and Pro editions will reach the end of support in 90 days but will switch to extended support and continue receiving security updates.

What this means for IT admins, global admins, and organizations running Exchange 2016/2013

  • IT admins and security teams: They will stop receiving security updates for Exchange 2016/2019 after October 2026 unless systems are migrated; the vendor recommendation is to upgrade to Exchange Server SE or migrate to Exchange Online.
  • Global admins and migration decision-makers: Microsoft points these administrators to its documentation site for detailed Microsoft 365 migration guidance and migration paths to Exchange Online or Exchange Server SE.
  • Organizations running Exchange 2016 or 2013: Microsoft explicitly advises these organizations to either upgrade directly to Exchange Server SE or first move to Exchange 2019 as an intermediate step before upgrading further.

Microsoft's announcement draws a firm line under the Exchange 2016/2019 lifecycle: the Period 2 ESU was a temporary accommodation, and October 2026 is the final cutoff the company will enforce. For any organization still maintaining production servers on those versions, the options are defined and time-bound — choose in-place upgrades to Exchange Server SE, stage upgrades via Exchange 2019, or migrate to Exchange Online — and do so before the ESU program closes. The company’s documentation and migration guidance are the immediate next references Microsoft has published for administrators planning that work.

Original story