Microsoft has confirmed that it will stop shipping security updates for Exchange 2016 and 2019 through its Extended Security Update (ESU) program in October. This marks the end of a six-month extension granted in April, which was intended to give customers more time to upgrade or migrate away from these outdated versions of the email server software.
The decision affects organizations that have been relying on the ESU program to keep their Exchange 2016 and 2019 servers secure. These versions reached mainstream support in October 2020 and January 2024, respectively, but Microsoft’s support lifecycle policies dictate that security updates will no longer be provided after October 2026. The company has advised IT administrators to upgrade to the latest version of Exchange Server, known as the Subscription Edition (SE), which can be installed directly on top of existing servers.
Microsoft has emphasized that there will be no further extensions to the ESU program, even for customers who are currently enrolled in the Period 2 Exchange ESU program. This means that once October arrives, all support for these versions of Exchange will cease, leaving organizations vulnerable to potential security threats and exploits. The company is urging admins to take immediate action and migrate their servers to a more secure version of the software.
The decision to end support for these older versions of Exchange comes as no surprise, given Microsoft’s commitment to improving the security posture of its products. In recent months, the company has taken steps to address vulnerabilities in other areas, such as Windows 10 and Windows Server. However, this move will undoubtedly cause inconvenience for some organizations that have yet to upgrade their email servers.
For those affected, the advice is clear: it’s time to act. Upgrading or migrating away from Exchange 2016 and 2019 should be a top priority. Microsoft has provided guidance on how to do so through its documentation site, which includes detailed information on how to migrate to Exchange Online (available as a standalone service or as part of an Office 365 subscription). Organizations that fail to take action will be exposed to potential security risks, making this a critical issue for IT administrators to address.
In conclusion, the end of support for Exchange 2016 and 2019 is a timely reminder for organizations to prioritize their email server security. With cyber threats becoming increasingly sophisticated, it’s essential that companies stay up-to-date with the latest software versions and security patches. By taking action now, admins can avoid potential headaches down the line and ensure their email servers remain secure and reliable.
Source: Bleeping Computer — 2026-07-22