Last month for Exchange 2016/2019: ESU program ends with October 2026

Exchange Server 2016 and 2019 reached end of support on 14 October 2025. The paid Extended Security Update (ESU) program now closes at the end of October 2026, and Microsoft has said there will be no further extension. For servers on ESU, this is the last month of updates. Here is what changes, the risks and your options.

At a glance

• End of support: Exchange Server 2016 and 2019 reached end of support on 14 October 2025.
• Servers without ESU: Exchange 2016/2019 servers not enrolled in the paid ESU program have received no security updates since 14 October 2025.
• Servers with ESU: Microsoft opened a second ESU period (Period 2), which ends with October 2026. In Microsoft's words: "Once October 2026 ends, there will be no further updates for Exchange 2016/2019, even if you currently have a Period 2 ESU."
• No extension: Microsoft states clearly that the ESU timeline will not be extended again.
• Options: Exchange Server Subscription Edition (SE) on-premises, Microsoft 365 / Exchange Online in the cloud, or a hybrid of both.

What changed?

When support ended, Microsoft stopped providing technical support, bug fixes and security updates for Exchange 2016 and 2019. The servers keep running, but Microsoft strongly recommends migrating as soon as possible.

For organizations that could not finish their migration, Microsoft offered a paid ESU program and later extended it with a second period. According to the Exchange team's July 2026 announcement, this second period ends with October 2026 and there will be no further extension. From November 2026, servers with ESU will also be permanently unpatched.

If you never joined the ESU program, this has already been the case for a year: your server has received no updates for newly discovered vulnerabilities since 14 October 2025.

Why internet-facing Exchange is a risk

Exchange servers are often directly exposed to the internet through Outlook on the web (OWA), the Exchange admin center (ECP/EAC), ActiveSync and Autodiscover. That makes them a prime target.

The cost has been high before. In March 2021, Microsoft reported zero-day vulnerabilities in on-premises Exchange Server (known as ProxyLogon, CVE-2021-26855 and related flaws) being used in attacks. According to Microsoft, attackers used them to access email accounts and install web shells, and other threat actors soon began targeting unpatched systems as well.

Back then a patch existed, and those who installed it quickly were protected. On an unsupported server, there will be no patch to install when a similar flaw appears.

October 2026 update: Critical Exchange flaw (CVE-2026-70571)

While this article was live, Microsoft released its October security update for Exchange Server on 13 October 2026, fixing a critical remote code execution flaw: CVE-2026-70571 (CVSS 3.1: 8.1; Microsoft severity: Critical). According to Microsoft, an unauthenticated attacker can send a specially crafted email to trigger an internal content-conversion process and execute code on the server; no user interaction is required. Microsoft says the flaw has not been exploited yet, but exploitation is considered more likely.

• Exchange SE: KB5128895
• Exchange 2019 CU15: KB5128896
• Exchange 2019 CU14: KB5128897
• Exchange 2016 CU23: KB5128898

For Exchange 2016/2019 this is the last security update available: the 2016/2019 updates are offered only to organizations enrolled in Period 2 ESU, and the program closes at the end of October 2026.

Earlier the same month, on 2 October 2026, CVE-2026-96940 (CVSS 8.8) also affected Exchange servers. According to Microsoft, an authenticated attacker could access other users' mailboxes in the same organization and read email. The fix arrived with the September 2026 V2 security updates (KB5129955 for Exchange SE); Microsoft applied the fix itself on the Exchange Online side.

In short: even with ESU, no patches will be released for flaws like these after October 2026. The migration plan (Exchange SE or Microsoft 365) needs to be completed this month.

Your options

1. Exchange Server SE (on-premises)

Exchange Server Subscription Edition is the on-premises successor to Exchange 2019.

• From Exchange 2019: Servers running Exchange 2019 CU14 or CU15 can be upgraded in place directly to Exchange SE. Microsoft describes SE as a cumulative upgrade to Exchange 2019 and the in-place upgrade as low risk. Servers below CU14 must be updated first.
• From Exchange 2016: There is no in-place upgrade path; a migration is required. According to Microsoft, before Exchange SE CU2 is released you can join an Exchange SE server to your existing Exchange 2016 (or mixed 2016/2019) organization and move mailboxes to it.
• Licensing: Microsoft says Exchange 2019 and Exchange SE licensing requirements are the same: a server license plus a CAL for each user or device. The difference: to keep using SE and receiving updates, you need active Software Assurance (SA) on server licenses and CALs, or a qualifying Microsoft 365 subscription. If SA is not renewed, the right to run SE ends.

2. Microsoft 365 / Exchange Online

Moving mailboxes to the cloud makes server updates, hardware and redundant infrastructure Microsoft's responsibility. During the ProxyLogon attacks, Microsoft noted that Exchange Online was not affected. For SMBs without a dedicated team to run a mail server, this is usually the most practical path.

3. Hybrid

You can move most mailboxes to Exchange Online and keep an on-premises Exchange server for management or specific needs. That remaining server must also run a supported version (Exchange SE).

Action plan for SMBs

1. Take inventory: Identify which servers run Exchange 2016 or 2019 and at which CU level. Confirm whether you are enrolled in ESU.
2. If you have ESU: Install every update released through the end of October 2026 and plan to complete your migration before November.
3. Choose a target: Exchange SE, Microsoft 365 or hybrid? Decide based on user count, IT staff, compliance requirements and budget.
4. Clarify licensing: For SE, check whether your existing licenses have active SA; for Microsoft 365, choose the right plan.
5. Reduce risk until you migrate: Avoid exposing OWA and ECP directly to the internet where possible, restrict access to admin interfaces, use multi-factor authentication and monitor server logs. These measures reduce risk but do not replace security updates.

Doğa Network nasıl yardımcı olabilir?

We can review your Exchange environment free of charge and help you choose the right path. Our team supports migrations to Microsoft 365 / Exchange Online, in-place upgrades from Exchange 2019 to Exchange SE, migrations from Exchange 2016, and licensing calculations (SA, CALs, Microsoft 365 plans). Reach us at +90 850 888 3642 or hi@doga.network.

Sources

• MSRC – CVE-2026-70571
• Microsoft Support – Exchange SE security update, 13 October 2026 (KB5128895)
• Microsoft Support – Exchange Server 2019 CU15 security update, 13 October 2026 (KB5128896)
• Microsoft Support – Exchange Server 2016 CU23 security update, 13 October 2026 (KB5128898)
• MSRC – CVE-2026-96940
• Microsoft Support – Exchange SE September 2026 V2 security update, 2 October 2026 (KB5129955)

• Microsoft Learn – Exchange Server 2019 and 2016 End of Support Roadmap
• Exchange Team Blog – Reminder: Exchange 2016 and 2019 ESU Program Ends in October 2026
• Exchange Team Blog – Announcing Exchange 2016 / 2019 Extended Security Update program
• Microsoft Learn – Exchange Server 2019 lifecycle
• Microsoft Learn – Exchange Server 2016 lifecycle
• Microsoft – Exchange Online and Exchange Server Licensing FAQs
• Microsoft Security Blog – HAFNIUM targeting Exchange Servers with 0-day exploits