Exchange Server SE CU1 Delayed as Microsoft Steps Up AI Security Testing

Microsoft has explained why Exchange Server Subscription Edition Cumulative Update 1, or CU1, did not arrive during the first half of 2026 as originally planned.

According to Microsoft, the Exchange team has spent significant time on security work, including using AI tools to find vulnerabilities and software bugs in Exchange Server SE.

The company has since moved the CU1 release window to the second half of 2026, although it still has not provided a specific launch date.

AI security testing is taking priority

Microsoft says its engineers are using AI-assisted tools to uncover security vulnerabilities and other issues in Exchange Server SE.

Finding those problems creates additional work for the Exchange team. Engineers need to investigate each issue, validate fixes, and prepare the monthly security updates that Microsoft continues to release for supported Exchange environments.

This security work has affected the CU1 development schedule, but Microsoft says development has not stopped.

Exchange Server SE CU1 is still in active development

Microsoft continues to work on CU1 and is adding recent Exchange security fixes to its internal CU1 builds.

The company plans to release the update after the build reaches the level of stability it considers suitable for customers.

Microsoft also wants to avoid releasing CU1 immediately before another Exchange security update. Doing so could force administrators to install CU1 and then deploy another security update shortly afterward.

Choosing a better release window should reduce the deployment workload for Exchange Server administrators.

Microsoft still expects CU1 within the coming months

Microsoft says Exchange Server SE CU1 should arrive within the coming months, keeping the release within the second half of 2026.

However, the company has not committed to a specific date, meaning administrators will need to wait for another announcement before planning the deployment.

The delay comes as Microsoft makes other changes across its Exchange products. The company plans to end Exchange 2016 and 2019 security updates in October, while OWA Light has been retired following a recent Exchange update.

Microsoft is also encouraging organizations to modernize other parts of their infrastructure, including its push for businesses to move beyond Active Directory and adopt Entra ID.