Microsoft to stop Exchange 2016 / 2019 security updates in October
Microsoft will stop security updates for Exchange 2016/2019 in October 2026.
Summary
Microsoft has announced that security updates for Exchange Server 2016 and 2019 will cease in October 2026, even for customers enrolled in the Extended Security Update (ESU) program. This marks the end of further extensions for these legacy versions, which have long passed their mainstream support dates. Admins are strongly advised to migrate to Exchange Server Subscription Edition or Microsoft 365.
Full text
Microsoft to stop Exchange 2016 / 2019 security updates in October By Sergiu Gatlan July 22, 2026 06:44 AM 0 Microsoft has reminded customers that it will stop shipping security updates for Exchange 2016 and 2019 through the Extended Security Update (ESU) program in October. This comes after a 6-month extension announced in April 2026 to the original ESU program, which began in October after Exchange Server 2016 and 2019 reached the end of support. Exchange 2016 reached mainstream support in October 2020, while Exchange 2019 mainstream support ended in January 2024. "Over the last several weeks we have received several questions about possible extension of the Exchange Server 2016/2019 ESU program past October 2026," the Exchange Server team said in a Monday blog post. "After all, in our original Exchange 2016/2019 ESU announcement we said that there would be no extensions, but then we ended up creating a Period 2 Exchange ESU program that is scheduled to end with October 2026. We are just about at the mid-point of Period 2 Exchange ESU now. "There will be no further extension of Exchange 2016/2019 ESU program timeline. Once October 2026 ends, there will be no further updates for Exchange 2016/2019, even if you currently have a Period 2 ESU." Admins advised to upgrade or migrate Microsoft advised IT admins to upgrade to Exchange Server Subscription Edition (SE), as they can perform in-place upgrades from Exchange Server 2019, a process identical to installing a Cumulative Update (CU). Admins who still have servers running Exchange 2016 or 2013 in production are also advised to directly upgrade to Exchange Server SE or, first, install Exchange 2019. Detailed Microsoft 365 migration guidance is available for global admins on Microsoft's documentation site, which also provides more information on how to migrate to Exchange Online (available as a standalone service or as an Office 365 subscription). In June, Microsoft quietly extended the free Windows 10 Extended Security Updates (ESU) program for consumers by an additional year, allowing enrolled devices to continue receiving security updates up until October 2027. Earlier this month, it also announced that Windows Server 2022 and Windows 11 24H2 Home and Pro editions will reach the end of support in 90 days, but will switch to extended support and continue receiving security updates. Test every layer before attackers do Security teams log 54% of successful attacks and alert on just 14%. The rest move through your environment unseen.The Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection. Get the whitepaper Related Articles: Microsoft patches Exchange Server zero-day exploited in attacksMicrosoft releases Windows 10 KB5099539 extended security updateMicrosoft quietly extends free Windows 10 ESU support to October 2027Microsoft July 2026 Patch Tuesday fixes massive 570 flaws, 3 zero-daysMicrosoft to retire the OWA Light client in Exchange Server