Microsoft Declares Exchange Server 2016/2019 'Permanently Vulnerable' as Support Ends

Microsoft has issued a stark warning to organizations still relying on Exchange Server 2016 and 2019, declaring them "permanently vulnerable." This declaration comes as the company has ceased all vulnerability testing and security updates for these older versions, with the latest security fixes exclusively targeting the newer Exchange Server Subscription Edition (SE).

The end of support for Exchange Server 2016 and 2019 officially passed on October 14, 2025. While Microsoft had offered an Extended Security Updates (ESU) program, it was explicitly stated that this program would not be extended beyond April 2026. However, due to persistent adoption of the older versions, Microsoft provided an additional six-month paid extension of security updates, which concluded with the final patches released on October 13, 2026.

According to Microsoft's Security Update Guide, the November security release addresses nine vulnerabilities within Exchange Server SE, including a critical remote code execution (RCE) flaw identified as CVE-2026-118207. Crucially, the documentation emphasizes that Exchange Server 2016 and 2019 are no longer subjected to vulnerability testing, and no further updates will be provided for them.

This move signifies a definitive end to security support for these widely deployed, but now outdated, on-premises email server solutions. Microsoft's directive is clear: "If you are using those versions of Exchange, you should consider them permanently vulnerable... and should upgrade your organization immediately."

The company has been actively encouraging a transition to newer on-premises versions or its cloud-based Microsoft 365 Exchange Online service for years. The discontinuation of support and patching for Exchange 2016 and 2019 leaves a significant attack surface for threat actors who may target organizations that have not yet migrated.

Organizations that continue to use these unsupported versions of Exchange Server are now exposed to any newly discovered vulnerabilities without the possibility of official patches. This significantly increases their risk profile, making them prime targets for attackers seeking to compromise email infrastructure for espionage, data theft, or further network infiltration.

The implications of this announcement are substantial for IT security teams. A proactive migration strategy to a supported version of Exchange or to Microsoft 365 is no longer a recommendation but an urgent necessity to maintain a secure operational environment and protect sensitive organizational data.