Microsoft Exchange Server 2016 and 2019 enter their 'permanently vulnerable' era
Microsoft declares Exchange Server 2016 and 2019 permanently vulnerable.
Microsoft has officially declared Exchange Server 2016 and 2019 as 'permanently vulnerable' as support and security updates have ceased. While an Extended Security Updates (ESU) program was offered, it concluded in April 2026, with a final six-month extension ending in October 2026. The company is no longer testing these older versions for vulnerabilities, urging customers to upgrade or migrate immediately.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Microsoft?
Get an email when a new story names Microsoft, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonMicrosoft has ended all security updates for Exchange Server 2016 and 2019, meaning any newly discovered vulnerabilities will never receive patches, leaving organizations running these versions permanently exposed. Exchange servers are high-value targets historically exploited by nation-state actors and ransomware groups, making unpatched instances an acute and ongoing risk. Organizations that failed to plan and execute timely migration to Exchange Online or a supported on-premises alternative now face an untenable security posture. This situation underscores the critical importance of tracking software lifecycle dates and treating end-of-support deadlines as hard migration deadlines, not soft suggestions.
What helps against this
How we list vendors
- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Automated patch management
Known holes get closed in days, not months.
- Cyber asset inventory
You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- cve — CVE-2026-118207