Microsoft has announced that it will stop shipping security updates for its Exchange 2016 and 2019 email server software through the Extended Security Update (ESU) program in October. This marks the end of a nearly two-year extension period, which was initially intended to provide extra support for organizations still running these outdated versions of Exchange.
The ESU program was first introduced after Microsoft ended mainstream support for Exchange Server 2016 and 2019, with Exchange 2016 reaching its mainstream support milestone in October 2020 and Exchange 2019’s mainstream support ending in January 2024. When the original ESU program was announced, Microsoft stated that there would be no extensions beyond the initial period. However, in April of this year, it revealed a second extension to the ESU program, which has now reached its midpoint.
Microsoft is advising IT administrators to upgrade or migrate from these outdated versions of Exchange as soon as possible. The company recommends upgrading to Exchange Server Subscription Edition (SE), which can be installed directly on existing servers running Exchange 2019. For organizations still using Exchange 2016 or the older Exchange 2013, Microsoft suggests either upgrading to SE or installing Exchange 2019 first before migrating to SE.
The move is part of a broader effort by Microsoft to encourage customers to adopt its more modern and secure email server solutions. As these older versions of Exchange reach their end of life, Microsoft will no longer provide security updates, leaving organizations vulnerable to potential exploits and attacks. In contrast, newer versions of Exchange and Office 365 offer enhanced security features and regular updates to protect against emerging threats.
The decision by Microsoft also highlights the ongoing challenges faced by IT administrators in maintaining outdated software systems. As vendors increasingly prioritize support for their latest products over legacy solutions, organizations must carefully plan and execute upgrades or migrations to stay secure and compliant with industry regulations.
To mitigate potential risks associated with this change, we recommend that IT teams thoroughly test and validate their systems before the October cutoff date. This includes verifying the compatibility of any third-party software or applications in use and ensuring that all necessary updates have been applied. By taking proactive steps now, organizations can minimize downtime and prevent potential security breaches when Microsoft officially ends support for these outdated versions of Exchange.
Ultimately, this announcement serves as a reminder to IT administrators to regularly assess their technology infrastructure and prioritize upgrades or migrations to more secure and supported solutions.
Source: Bleeping Computer — 2026-07-22