Microsoft Exchange Server 2016 and 2019 enter their 'permanently vulnerable' era
Upgrade, migrate, but don't prevaricate – time has run out
Microsoft has declared that Exchange Server 2016 and 2019 are now permanently vulnerable following the release of security updates for the Subscription Edition. The warning is found in the documentation for November's security update for Exchange Server SE. Microsoft states that these versions of Exchange are no longer tested for vulnerabilities and that no updates are being released for them.
The company has been emphasizing that customers using these versions should upgrade immediately for security reasons. Support for Exchange Server 2016 and 2019 officially ended on October 14, 2025, but Microsoft extended the Extended Security Updates program until April 14, 2026. However, this extension was also canceled on April 14, 2026.
Microsoft offered a final six-month extension of paid security updates for these versions, but it became clear that some customers were still using the old software. The final Exchange Server 2016 and 2019 security updates were released on October 13, 2025, marking the end of any further patches or vulnerability testing for these versions.
Written by urgent.news from The Register's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
