Microsoft sets a hard stop for Exchange 2016 and 2019 security fixes

Key points

• Microsoft will stop issuing security updates for Exchange Server 2016 and 2019 in October 2026, with no further extensions.
• The paid Extended Security Update program was already extended once, by six months, and Microsoft says that was the final reprieve.
• Businesses still running these email servers are being told to move to Exchange Server Subscription Edition or to Exchange Online in the cloud.
• Exchange 2016 left mainstream support in October 2020, and Exchange 2019 followed in January 2024.

Microsoft has drawn a firm line under two of its most widely used business email products. After October 2026, Exchange Server 2016 and Exchange Server 2019 will stop receiving security patches. That is true even for customers who paid to stay on the Extended Security Update program, which Microsoft calls ESU.

Extended Security Updates are the paid safety net Microsoft offers after a product officially retires. You keep getting fixes for serious flaws, but nothing else. The program for Exchange 2016 and 2019 started in October 2025, when both products reached end of support.

In April, Microsoft added six more months to that safety net. It has now said, in a blog post from the Exchange Server team first reported by BleepingComputer, that there will be no more extensions.

"There will be no further extension of Exchange 2016/2019 ESU program timeline," the team wrote. "Once October 2026 ends, there will be no further updates for Exchange 2016/2019, even if you currently have a Period 2 ESU."

Translation: the clock is real this time.

What happens if a company keeps running these servers?

Nothing, at first. The servers will keep sending and receiving email. The problem is what comes later.

Once Microsoft stops shipping patches, any new security flaw discovered in Exchange 2016 or 2019 stays unfixed. Forever. And Exchange has a long, unhappy history of serious flaws being exploited within days of disclosure. The 2021 ProxyLogon and ProxyShell attacks, which let attackers take over Exchange servers and read every mailbox on them, are the textbook examples.

An unpatched Exchange server sitting on the public internet is a genuinely dangerous thing to own. It handles email, calendars, and often the identity of every employee at the company. If attackers get in, they can read messages, impersonate staff, and pivot to the rest of the network.

What is Microsoft telling IT teams to do?

Upgrade or move to the cloud. Those are the two paths.

The upgrade path is Exchange Server Subscription Edition, or Exchange Server SE. It is the new on-premises version, which means it runs on servers the company owns rather than in Microsoft's cloud. Customers already on Exchange 2019 can do an in-place upgrade, which Microsoft says works like installing a normal update.

Anyone still running the older Exchange 2016 or the even older Exchange 2013 has more work to do. Microsoft's advice is to go to Exchange Server SE directly, or first move to Exchange 2019 and then upgrade.

The other option is Exchange Online, the hosted version that comes as part of Microsoft 365 or as a standalone subscription. That removes the patching problem entirely, because Microsoft runs the servers.

Does any of this affect ordinary people?

Not directly, and not immediately. This is a deadline for IT departments, not for home users.

But it matters indirectly. If your employer, your doctor's office, or your local council runs an old Exchange server past October 2026 and does not migrate, their email system becomes a soft target. That can end in a breach that exposes staff and customer data.

If you work somewhere that still runs on-premises Exchange, this is a fair question to ask your IT team: what is the plan for October 2026? A vague answer is a warning sign.

Microsoft has been unusually direct here. The company that spent years quietly extending deadlines has, this time, stopped moving the goalposts. Whether that survives contact with reality next October is another matter.