Microsoft Ends Security Updates for Exchange Server 2016 and 2019, Leaving Them Permanently Vulnerable

Microsoft has warned that Exchange Server 2016 and 2019 are now permanently vulnerable after the end of their security support. Organizations still running either version will no longer receive security patches, leaving their systems exposed to newly discovered vulnerabilities.

According to Microsoft’s November 2026 security announcement, the company no longer tests unsupported Exchange Server versions for security vulnerabilities or develops fixes for newly discovered flaws.

Exchange Server 2016 and 2019 will no longer receive security updates

Microsoft ended regular support for Exchange Server 2016 and 2019 in October 2025. The company subsequently offered two additional six-month Extended Security Update (ESU) periods to give organizations more time to migrate.

However, the final extended security support period expired in October 2026, leaving both products without further security updates.

Microsoft warns that organizations continuing to operate these versions must now consider them permanently vulnerable. Even if administrators apply every previously released security update, newly discovered vulnerabilities will remain unpatched.

The company will no longer investigate security flaws affecting these unsupported versions or provide fixes through its regular security update process.

This creates additional security risks for organizations that rely on older Exchange Server deployments for email communication and other business operations.

Microsoft recommends upgrading to Exchange Server Subscription Edition

Microsoft recommends that organizations still using Exchange Server 2016 or 2019 migrate to a supported platform as soon as possible.

Exchange Server Subscription Edition (SE) is now the only supported on-premises Exchange Server version that continues to receive security updates.

The warning comes alongside Microsoft’s November 2026 Patch Tuesday updates, which address several Windows Server and Exchange-related issues.

Microsoft has also reminded organizations about upcoming support deadlines for other server products. The company previously warned that Windows Server 2016 support is ending soon, urging administrators to prepare their upgrade plans.

Separately, Microsoft recently introduced the Windows Server Technology Adoption Program, allowing organizations to test upcoming Windows Server capabilities and provide feedback before broader releases.

Organizations that continue running Exchange Server 2016 or 2019 should prioritize migration, as installing existing patches will no longer protect these systems against future vulnerabilities.