Exchange Server 2016 and 2019 Are Now Permanently Vulnerable

Exchange Server 2016 and Exchange Server 2019 have reached the point Microsoft spent a year warning about. The November 2026 Exchange security updates, released on 10 November, ship for Exchange Server Subscription Edition (SE) only. In the release notes, the Exchange team states that "Exchange Server 2016 and 2019 are no longer tested for vulnerabilities and there are no updates released", advises that both versions should be considered "permanently vulnerable" and tells customers to "upgrade your organization immediately".

For anyone who still runs an on-premises Exchange 2016 or 2019 server that accepts or relays mail from the internet, every new Exchange vulnerability disclosed from now on stays open on that server. Even organisations that paid for the extended support program have received their last patch.

How Exchange 2016 and 2019 got here

Mainstream and extended support for both versions ended on 14 October 2025, as listed on the Microsoft lifecycle page for Exchange Server 2019. Microsoft then ran paid Extended Security Update programs for customers who needed more time to move to Exchange SE. The first period was due to end in April 2026; Microsoft followed it with a second period, the Period 2 ESU, which it described as a program "for Exchange customers who need extra time to migrate to Exchange SE".

In a reminder published on 20 July 2026, the Exchange team wrote that "there will be no further extension of Exchange 2016/2019 ESU program timeline" and that once October 2026 ends, "there will be no further updates for Exchange 2016/2019", even for ESU customers.

The October 2026 security update, released on 13 October, was the last one. It covered Exchange SE RTM, Exchange 2019 CU14 and CU15, and Exchange 2016 CU23, the two older versions only for Period 2 ESU customers. Microsoft wrote that October 2026 is the last month in which enrolled customers can receive new 2016 and 2019 updates, that future updates and CVE announcements will cover Exchange SE only, and that it will stop testing the older versions. Period 2 ESU can still be bought for a limited time, but only to bring a server current up to that October release.

What the November release changes

The November 2026 security update is the first one that leaves 2016 and 2019 out entirely. It addresses nine vulnerabilities in Exchange Server SE, including one rated critical: a remote code execution flaw tracked as CVE-2026-118207. Details of each fix are in the Microsoft Security Update Guide, under the Server Software product family.

Microsoft does not say whether the November flaws also exist in Exchange 2016 or 2019. That is the point of its warning: those versions are no longer tested, so nobody will tell administrators whether a new CVE applies to them, and no fix will follow either way.

Exchange Online customers are already protected, according to Microsoft. Organisations running a hybrid deployment still need to patch their on-premises servers, and Microsoft notes that if the auth certificate is changed after an update in hybrid mode, the Hybrid Configuration Wizard must be run again.

A separate Windows Server issue

Administrators who held off on October patches should know about one more item. Microsoft has acknowledged that Exchange servers may become unstable after the October 2026 Windows Server updates. Its fix is to install the November 2026 Windows Server updates; installing the Exchange security update does not solve it, and the order of the Windows and Exchange updates does not matter.

Why it matters for email delivery

An on-premises Exchange server is often the internet-facing SMTP gateway of an organisation: it receives inbound mail, relays outbound mail and holds the mailboxes. A mail server that can no longer be patched is a server that attackers can keep targeting with every newly disclosed flaw. When a mail server is compromised, the damage reaches the domain and the IP addresses it sends from: outbound spam or phishing from those IPs can lead to blocklist listings and rejections at Microsoft, Gmail and other receivers, which then hit legitimate mail too.

The same applies to application servers and devices that relay through an internal Exchange server. If that server has to be taken offline after an incident, password resets, invoices and alerts that depend on it stop with it.

Action checklist

• Inventory every Exchange server you run, including edge, relay-only and management-tools servers, and note its version and CU.
• Run the Exchange Health Checker (aka.ms/ExchangeHealthChecker) to find servers behind on CUs, security updates or manual steps.
• Plan the move to Exchange SE or Exchange Online. Microsoft describes an in-place upgrade from Exchange 2019 CU14 or CU15 to Exchange SE RTM as low risk, and states that Exchange 2019 and Exchange SE have the same licensing requirements.
• Install the November 2026 Exchange SE update on every SE server and management workstation, then reboot and confirm the Exchange services started.
• Apply the November 2026 Windows Server updates if your Exchange servers became unstable after the October Windows updates.
• Reduce exposure until migration: limit which hosts can reach the server from the internet and check that it cannot relay mail for unauthenticated senders.
• Watch your sending IPs for blocklist listings and sudden outbound volume, which are early signs of a compromised mail server.

Sources

1. Microsoft Exchange Team: Released November 2026 Exchange Server Security Updates, 10 November 2026 (primary source)
2. Microsoft Exchange Team: Released October 2026 Exchange Server Security Updates, 13 October 2026
3. Microsoft Exchange Team: Reminder, Exchange 2016 and 2019 ESU program ends in October 2026, 20 July 2026
4. Microsoft Lifecycle: Exchange Server 2019
5. Microsoft Security Update Guide

Related on SMTPedia

• Microsoft patches exploited Outlook flaw that leaks NTLM hashes
• 550 5.1.0 ETP202: your IP is listed by Spamhaus (Exchange)
• Microsoft 365 SMTP, IMAP and POP3 settings