"Exchange Server 2016 and 2019 are no longer tested for vulnerabilities and there are no updates released. If you are using those versions of Exchange, you should consider them permanently vulnerable [Microsoft's emphasis] and should upgrade your organization immediately." — Microsoft, in November Exchange Server SE security update release documentation.
Microsoft's blunt declaration and where it appears
The line above appears in Microsoft's release documentation for the November security update for Exchange Server Subscription Edition (SE). The company explicitly told customers that Exchange Server 2016 and 2019 "are no longer tested for vulnerabilities and there are no updates released" and urged an immediate upgrade. The wording — including the phrase "permanently vulnerable" — is Microsoft’s own emphasis in guidance appended to the SE bulletin.
Support and the Extended Security Updates (ESU) arc
Official support for Exchange Server 2016 and 2019 ended on October 14, 2025. In July 2025 Microsoft announced an Extended Security Updates program intended to bridge customers to a later or online version. At announcement the company said the ESU period "will not be extended past April 2026 (you do not need to ask)." When April 2026 arrived, however, Microsoft offered another six months of paid security updates to customers who had not migrated. Those final weeks before the last patches were also marked by an additional complication: a Windows Server update that broke Exchange Server.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleFinal patches, Subscription Edition-only fixes, and CVE-2026-118207
Microsoft released the final security updates for Exchange Server 2016 and 2019 on October 13, 2026. In November, the company issued fixes only for Exchange Server Subscription Edition — the Security Update Guide shows the November update addressed nine vulnerabilities in SE, including a critical remote code execution flaw identified as CVE-2026-118207. Microsoft’s documentation makes clear it is not testing earlier versions of Exchange for vulnerabilities nor releasing further updates for those versions.
What this means for technologists, procurement leaders, and threat actors
- Technologists and security teams: Microsoft’s guidance is unambiguous — servers running Exchange Server 2016 or 2019 are described as "permanently vulnerable" and customers are told to "upgrade your organization immediately." With testing and updates halted for those versions after October 13, teams who have not migrated face a clear maintenance and risk decision.
- Procurement and IT leadership: The ESU program was sold as a temporary bridge. Microsoft initially set an April 14, 2026 cutoff and later granted a six-month paid extension; with final updates deployed on October 13, organizations must now weigh migration costs against operating systems the vendor has declared unsupported and untested.
- Adversaries and opportunists: By labeling specific product versions as no longer tested and without further updates, Microsoft has effectively marked Exchange Server 2016 and 2019 installations as legacy targets. That designation—combined with the absence of ongoing patches—creates a clear distinction between SE (which received November fixes) and earlier versions that Microsoft says should be considered permanently vulnerable.
Immediate choices for organizations still running 2016 or 2019
Organizations still operating Exchange Server 2016 or 2019 face three plainly stated options as reflected in Microsoft's communications: migrate to a later or online version, purchase time-limited paid ESU when it was offered, or acknowledge that their installations will no longer be tested or patched and therefore remain exposed. The company’s messaging assumes migration to a newer release or an online service as the intended outcome — the July 2025 ESU announcement framed April 2026 as the end point, and Microsoft told customers they "do not need to ask" for a further extension. Nevertheless, Microsoft granted a six-month paid extension in April 2026 before issuing the final round of patches in October.
Microsoft’s final posture is straightforward: support for 2016 and 2019 has ended, ESU has been exhausted, and the company will not continue testing or releasing updates for those versions. For any organization that did not complete a migration by October 13, the company’s public guidance is to treat those installations as permanently vulnerable.
