[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f2hwWkI3HiC4WU3K64ADYsc9myl0uWVXKZ9fKmfqmobQ":3},{"article":4,"iocs":40,"watch_terms":45,"solutions":46,"lesson":136},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":27,"category":28,"article_tags":32},"363ee090-6e56-4921-bf2c-8bb3776b6d1d","Microsoft Exchange Server 2016 and 2019 enter their 'permanently vulnerable' era","microsoft-exchange-server-2016-and-2019-enter-their-permanently-vulnerable-era-322862","Upgrade, migrate, but don't prevaricate – time has run out","Microsoft has officially declared Exchange Server 2016 and 2019 as 'permanently vulnerable' as support and security updates have ceased. While an Extended Security Updates (ESU) program was offered, it concluded in April 2026, with a final six-month extension ending in October 2026. The company is no longer testing these older versions for vulnerabilities, urging customers to upgrade or migrate immediately.","Microsoft declares Exchange Server 2016 and 2019 permanently vulnerable.","https:\u002F\u002Fwww.theregister.com\u002Fsaas\u002F2026\u002F11\u002F12\u002Fmicrosoft-exchange-server-2016-and-2019-enter-their-permanently-vulnerable-era\u002F5309401","https:\u002F\u002Fimage.theregister.com\u002F?imageId=246612&width=800","2026-11-12T14:55:00+00:00","2026-11-12T15:00:21.121076+00:00",8,[17,20,22,24],{"name":18,"type":19},"Exchange Server 2016","product",{"name":21,"type":19},"Exchange Server 2019",{"name":23,"type":19},"Exchange Server SE",{"name":25,"type":26},"Microsoft","vendor","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":27,"icon":29,"name":30,"slug":31},null,"Vulnerabilities","vulnerabilities",[33,35],{"category":34},{"id":27,"icon":29,"name":30,"slug":31},{"category":36},{"id":37,"icon":29,"name":38,"slug":39},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",[41],{"type":42,"value":43,"context":44},"cve","CVE-2026-118207","Critical remote code execution flaw fixed in Exchange Server SE November update.",[25,18,21],{"controls":47,"vendors":130},[48,77,102],{"slug":49,"name":50,"problem":51,"products":52},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[53,61,69],{"vendor_slug":54,"vendor_name":55,"vendor_logo":56,"product_slug":57,"product_name":58,"url":59,"description":60},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":62,"vendor_name":63,"vendor_logo":64,"product_slug":65,"product_name":66,"url":67,"description":68},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"vendor_slug":70,"vendor_name":71,"vendor_logo":72,"product_slug":73,"product_name":74,"url":75,"description":76},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"slug":78,"name":79,"problem":80,"products":81},"patch-management","Automated patch management","Known holes get closed in days, not months.",[82,86,94],{"vendor_slug":70,"vendor_name":71,"vendor_logo":72,"product_slug":78,"product_name":83,"url":84,"description":85},"Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"vendor_slug":87,"vendor_name":88,"vendor_logo":89,"product_slug":90,"product_name":91,"url":92,"description":93},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":95,"vendor_name":96,"vendor_logo":97,"product_slug":98,"product_name":99,"url":100,"description":101},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"slug":103,"name":104,"problem":105,"products":106},"asset-inventory","Cyber asset inventory","You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.",[107,114,122],{"vendor_slug":108,"vendor_name":109,"vendor_logo":110,"product_slug":111,"product_name":109,"url":112,"description":113},"lansweeper","Lansweeper","\u002Fvendor-logos\u002Flansweeper.png","lansweeper-asset-inventory","https:\u002F\u002Fwww.lansweeper.com\u002Fproduct\u002Fasset-inventory\u002F","Discovery with and without agents that keeps one central, always-updated inventory of devices, software and their details.",{"vendor_slug":115,"vendor_name":116,"vendor_logo":117,"product_slug":118,"product_name":119,"url":120,"description":121},"runzero","runZero","\u002Fvendor-logos\u002Frunzero.png","runzero-platform","runZero Platform","https:\u002F\u002Fwww.runzero.com\u002Fplatform\u002F","Finds and fingerprints everything on the network and in the cloud, including IoT and OT devices, without agents or credentials, and flags exposures.",{"vendor_slug":123,"vendor_name":124,"vendor_logo":125,"product_slug":126,"product_name":127,"url":128,"description":129},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-cyber-assets","Axonius Cyber Assets","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fcyber-assets","A continuously reconciled view of every asset, who owns it, which security controls cover it and where it drifts from policy.",[131],{"slug":132,"name":25,"logo_path":133,"roles":134},"microsoft","\u002Fvendor-logos\u002Fmicrosoft.png",[135],"affected",{"slug":137,"title":138,"body":139,"framework_refs":140,"framework_notes":145},"exchange-server-20162019-reach-permanently-vulnerable-status-after-end-of-support","Exchange Server 2016\u002F2019 Reach 'Permanently Vulnerable' Status After End of Support","Microsoft has ended all security updates for Exchange Server 2016 and 2019, meaning any newly discovered vulnerabilities will never receive patches, leaving organizations running these versions permanently exposed. Exchange servers are high-value targets historically exploited by nation-state actors and ransomware groups, making unpatched instances an acute and ongoing risk. Organizations that failed to plan and execute timely migration to Exchange Online or a supported on-premises alternative now face an untenable security posture. This situation underscores the critical importance of tracking software lifecycle dates and treating end-of-support deadlines as hard migration deadlines, not soft suggestions.",[141,142,143,144],"CIS Control 2: Inventory and Control of Software Assets (v8)","CIS Control 7: Continuous Vulnerability Management (v8)","NIST SP 800-53 SI-2: Flaw Remediation","NIS2 Article 21(2)(e)",{"NIS2 Article 21(2)(e)":146,"NIST SP 800-53 SI-2: Flaw Remediation":147,"CIS Control 7: Continuous Vulnerability Management (v8)":148,"CIS Control 2: Inventory and Control of Software Assets (v8)":149},"NIS2 Article 21(2)(e) mandates security in acquisition, development, and maintenance including vulnerability handling; continuing to operate end-of-life software that cannot receive vulnerability patches is a direct failure of this obligation.","SI-2 requires organizations to identify, report, and correct information system flaws; operating a mail server for which the vendor will no longer release flaw corrections makes compliance with this control impossible without migration.","CIS Control 7 calls for ongoing vulnerability assessment and remediation prioritization; running software that will never again receive security patches is a direct violation of the continuous remediation principle this control mandates.","CIS Control 2 requires organizations to track software lifecycle status; maintaining this inventory would have surfaced the impending Exchange end-of-support date in time to plan an orderly migration."]