Microsoft Exchange Server 2016 and 2019 enter their 'permanently vulnerable' era
Microsoft has warned customers still clinging to Exchange Server 2016 and 2019 to consider the software "permanently vulnerable" as November's security fixes arrive for Subscription Edition (SE) alone.
Key points
- If you are using those versions of Exchange, you should consider them permanently vulnerable [Microsoft's emphasis] and should upgrade your organization immediately." You have been warned.
- According to Microsoft's Security Update Guide, the November update fixed nine vulnerabilities in Exchange Server SE, including a critical remote code execution flaw, CVE-2026-118207.
- As April 2026 rolled around, and it became clear that some customers were still stubbornly sticking with the old versions, Microsoft did the equivalent of heaving an exasperated sigh and offered another six months of paid security updates.
Microsoft stated: "Exchange Server 2016 and 2019 are no longer tested for vulnerabilities and there are no updates released.
Support for Exchange Server 2016 and 2019 ended on October 14, 2025, but the company announced an Extended Security Updates (ESU) program in July 2025.
Additional details
- The warning appears in the release documentation for November's Exchange Server SE security update.
- Those final weeks also brought a separate treat: a Windows Server update breaking Exchange Server.
- Microsoft isn't testing earlier versions of Exchange for the vulnerabilities.
- The plan was that this program would end on April 14, 2026, by which time customers would surely have made the jump to a later or online version, right?
- The company said: "This period will not be extended past April 2026 (you do not need to ask)." And...
How this summary was made: extractive summary — built from the sources' own reporting. It is drawn only from the reporting of the sources listed below — read the originals for full detail. How we summarize →
Advertisement
Every article behind this summary — 1 article from 1 outlet
Get stories like this in your inbox.
Subscribe — it's freeOne free email at 6am — your topics, deduplicated, five minutes. No account, no paywall.