Microsoft Ends Security Updates for Exchange and Skype for Business Servers

Microsoft officially ended Extended Security Updates (ESU) for Exchange Server 2016 and 2019, along with Skype for Business Server 2015 and 2019, on October 13, 2026.

The products originally reached end of support in October 2025, but Microsoft offered organizations an additional year of paid security updates. The ESU program covered two six-month periods, with the second beginning in April 2026.

According to Microsoft’s announcements for Exchange Server and Skype for Business Server, the October 13 updates marked the end of security maintenance for these legacy products.

Microsoft releases final security updates

Microsoft delivered the last security updates for Exchange Server 2016 and 2019 and Skype for Business Server 2015 and 2019 as part of the October 2026 Patch Tuesday.

The company distributed these updates privately to organizations that purchased Period 2 of the ESU program.

Microsoft also confirmed that it will no longer test these older server versions for newly discovered vulnerabilities or include them as affected products in Microsoft Security Response Center (MSRC) security advisories.

However, this does not mean the servers are free from security risks. New vulnerabilities could still affect these products, but Microsoft will no longer provide patches to address them.

Subscription Edition becomes the only supported option

With the ESU program ending, Exchange Server Subscription Edition (SE) is now the only supported on-premises Exchange Server version that continues to receive security updates.

Similarly, Skype for Business Server Subscription Edition (SE) is the only supported version of Microsoft’s on-premises communications server.

Microsoft will continue allowing organizations to purchase Period 2 ESU for a limited time, giving them access to the final October 2026 security updates. However, the company will not release additional updates for the older server versions.

Organizations still running these products should migrate to supported versions to avoid leaving their infrastructure exposed to unpatched vulnerabilities.

In other news, 0patch has released fixes for a critical Windows Server DNS vulnerability affecting older systems. Meanwhile, LibreOffice offers a free alternative to Microsoft Publisher, following Microsoft’s decision to end support for Office LTSC 2021.