Microsoft sets a hard stop for Exchange 2016 and 2019 security fixes

Key points

• Microsoft will stop issuing security updates for Exchange Server 2016 and 2019 in October 2026, with no further extensions.
• The paid Extended Security Update program was extended once, by six months in April 2026, and Microsoft says that was the final reprieve.
• Businesses still running these email servers are being told to move to Exchange Server Subscription Edition or to Exchange Online.
• Exchange 2016 left mainstream support in October 2020; Exchange 2019 followed in January 2024.

Microsoft has drawn a firm line under two of its most widely used business email products. After October 2026, Exchange Server 2016 and Exchange Server 2019 will stop receiving security patches, including for customers who paid into the Extended Security Update program, which Microsoft calls ESU.

Extended Security Updates are the paid safety net Microsoft offers after a product officially retires: you keep getting fixes for serious flaws, but nothing else. The ESU program for Exchange 2016 and 2019 began in October 2025, when both products reached end of support. In April 2026, Microsoft added six more months to that window. It's now said, in a blog post from the Exchange Server team first reported by BleepingComputer, that there won't be more extensions.

"There will be no further extension of Exchange 2016/2019 ESU program timeline," the team wrote. "Once October 2026 ends, there will be no further updates for Exchange 2016/2019, even if you currently have a Period 2 ESU."

The clock is real this time.

What happens if a company keeps running these servers?

Nothing, at first. The servers will keep handling mail. The danger accumulates quietly: once Microsoft stops shipping patches, any new security flaw discovered in Exchange 2016 or 2019 stays unfixed permanently. Exchange has a long, unhappy history of serious vulnerabilities being exploited within days of disclosure. The 2021 ProxyLogon and ProxyShell attacks, which let attackers seize Exchange servers and read every mailbox on them, are the textbook examples.

An unpatched Exchange server on the public internet is a genuinely dangerous thing to own. It holds email, calendars and often the credentials of every employee at the company. Attackers who get in can impersonate staff and pivot to the rest of the network. We covered a similar dynamic on 20 July in our report on SonicWall appliances being compromised weeks before a fix existed: the gap between discovery and patch is exactly where intruders work.

What is Microsoft telling IT teams to do?

Upgrade or move to the cloud. Those are the two paths.

The upgrade path is Exchange Server Subscription Edition, or Exchange Server SE, the current on-premises version. Customers already on Exchange 2019 can do an in-place upgrade, which Microsoft says is identical to installing a cumulative update. Anyone still on Exchange 2016 or Exchange 2013 needs to either jump directly to Exchange Server SE or move to Exchange 2019 first and upgrade from there.

The cloud path is Exchange Online, available as a standalone service or as part of a Microsoft 365 subscription. That removes the patching problem entirely, because Microsoft runs and patches the servers.

Does any of this affect ordinary people?

Not directly, not immediately. This is a deadline for IT departments.

It matters indirectly, though. If your employer or local council runs an old Exchange server past October 2026 without migrating, their email system becomes a soft target. That can end in a breach exposing staff and customer data. Worth noting: our 16 July story on Windows 11 24H2 reaching its own October 2026 support cut-off shows how many organisations are simultaneously managing multiple end-of-support deadlines this autumn.

Microsoft's been unusually direct here. The company that spent years quietly extending deadlines has, this time, stopped moving the goalposts. Whether the firm resolve survives contact with customer pressure next autumn is worth watching.