Microsoft Exchange Server 2016 and 2019 enter their 'permanently vulnerable' era

Microsoft has warned customers still clinging to Exchange Server 2016 and 2019 to consider the software "permanently vulnerable" as November's security fixes arrive for Subscription Edition (SE) alone.

The warning appears in the release documentation for November's Exchange Server SE security update.

Looking for Exchange 2016 and 2019 information? Tough. Microsoft stated: "Exchange Server 2016 and 2019 are no longer tested for vulnerabilities and there are no updates released. If you are using those versions of Exchange, you should consider them permanently vulnerable [Microsoft's emphasis] and should upgrade your organization immediately." You have been warned.

REG AD

Support for Exchange Server 2016 and 2019 ended on October 14, 2025, but the company announced an Extended Security Updates (ESU) program in July 2025. The plan was that this program would end on April 14, 2026, by which time customers would surely have made the jump to a later or online version, right? The company said: "This period will not be extended past April 2026 (you do not need to ask)."

REG AD

And... of course it was. As April 2026 rolled around, and it became clear that some customers were still stubbornly sticking with the old versions, Microsoft did the equivalent of heaving an exasperated sigh and offered another six months of paid security updates. Those final weeks also brought a separate treat: a Windows Server update breaking Exchange Server.

This time it was serious. Microsoft released the final Exchange Server 2016 and 2019 security updates on October 13. No more patches, no more vulnerability testing, and apparently no more reprieves.

According to Microsoft's Security Update Guide, the November update fixed nine vulnerabilities in Exchange Server SE, including a critical remote code execution flaw, CVE-2026-118207. Microsoft isn't testing earlier versions of Exchange for the vulnerabilities. ®