Exchange 2016/2019 Security Updates Stops in October

Overview

Microsoft has confirmed that security updates for Exchange Server 2016 and 2019 will officially end in October 2026, marking the conclusion of the Extended Security Update (ESU) program. This follows a six‑month extension announced earlier this year, but Microsoft has now made it clear: no further extensions will be offered.

Timeline of Support

• Exchange 2016: Mainstream support ended in October 2020.
• Exchange 2019: Mainstream support ended in January 2024.
• ESU Program: Began in October 2025, extended once in April 2026, now ending in October 2026.
• After this date, no further updates — including security patches — will be released, even for customers enrolled in Period 2 ESU.

Microsoft’s Guidance for Admins

Microsoft is urging IT administrators to take immediate action:

• Upgrade to Exchange Server Subscription Edition (SE) — supports in‑place upgrades from Exchange 2019, similar to installing a cumulative update.
• Migrate from Exchange 2016/2013 — either directly to SE or via Exchange 2019 first.
• Move to Exchange Online — available as a standalone service or bundled with Microsoft 365 subscriptions.

Microsoft’s documentation provides detailed migration guidance for global admins, covering both on‑premises upgrades and cloud migrations.

Security Implications

Running unsupported Exchange servers poses significant risks:

• Unpatched vulnerabilities could be exploited by attackers.
• Compliance failures in regulated industries.
• Operational instability due to incompatibility with newer Microsoft 365 features.

Given Exchange’s history of being a high‑value target for cyberattacks, organizations cannot afford to delay migration.

Related Microsoft Lifecycle Updates

• Windows 10 ESU: Extended by one year, now supported until October 2027.
• Windows Server 2022 and Windows 11 24H2 Home/Pro: Will reach end of support in 90 days but transition to extended support with continued updates.

Expert in the Cloud Insight

This announcement is a final wake‑up call for organizations still running legacy Exchange servers. The end of ESU means no more safety nets — leaving systems exposed to evolving threats. The strategic move is clear: upgrade to Exchange SE or migrate to Exchange Online to ensure resilience, compliance, and long‑term security.