Microsoft Ends Security Updates for Exchange 2016/2019 in October

Post Views: 13

Microsoft will stop providing security updates for Exchange Server 2016 and 2019 via the Extended Security Update (ESU) program in October 2026.

Microsoft Ends Security Updates for Exchange Server 2016 and 2019

Microsoft has informed users that it will cease providing security updates for Exchange Server 2016 and 2019 through the Extended Security Update (ESU) program in October. This follows a six-month extension of the ESU initiative, initially announced in April 2026, which was part of a broader timeline for the support lifecycle of these versions.

Support Lifecycle Timeline

Exchange Server 2016 transitioned to mainstream support in October 2020, while Exchange Server 2019’s mainstream support concluded in January 2024. The Exchange Server team addressed inquiries about potential extensions to the ESU program in a Monday blog post, stating, “Over the last several weeks we have received several questions about possible extension of the Exchange Server 2016/2019 ESU program past October 2026.”

The team clarified that while the original ESU announcement did not include extensions, a second phase of the program was introduced, set to expire in October 2026. “We are just about at the mid-point of Period 2 Exchange ESU now,” the statement noted. “There will be no further extension of Exchange 2016/2019 ESU program timeline. Once October 2026 ends, there will be no further updates for Exchange 2016/2019, even if you currently have a Period 2 ESU.”

Recommendations for IT Administrators

IT administrators are urged to transition to Exchange Server Subscription Edition (SE), which allows in-place upgrades from Exchange Server 2019 via a process similar to installing a Cumulative Update (CU). Organizations still operating Exchange 2016 or 2013 in production environments are advised to migrate directly to Exchange Server SE or first deploy Exchange 2019 before upgrading.

Migration Guidance

Microsoft’s documentation site provides detailed guidance for global administrators on migrating to Microsoft 365, including steps for transitioning to Exchange Online as a standalone service or through an Office 365 subscription. In June, Microsoft extended the free Windows 10 Extended Security Updates (ESU) program for consumer devices by one year, ensuring security updates until October 2027.

Earlier this month, the company also announced that Windows Server 2022 and Windows 11 24H2 Home and Pro editions will reach end-of-support in 90 days but will transition to extended support, continuing to receive security updates.

Security Alert and Call to Action

Security teams log 54% of successful attacks and alert on just 14%. The rest move through your environment unseen. The Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection. Get the whitepaper.