Microsoft Ends Extended Security Updates for Exchange 2016/2019 in October 2026
Microsoft has confirmed that the Extended Security Update (ESU) program for Exchange Server 2016 and 2019 will conclude in October 2026, leaving organizations without official security patches.
Microsoft has issued a final reminder to its customers that security updates for Exchange Server 2016 and Exchange Server 2019 will cease in October 2026, even for those enrolled in the Extended Security Update (ESU) program. This marks the definitive end of official support and patching for these legacy email server versions, potentially exposing organizations that have not yet migrated to newer platforms to significant security risks.
The ESU program, initially intended to provide a limited window for organizations to transition, had already received a six-month extension. This extension was announced in April 2026, pushing the final ESU deadline to October 2026, after the original end-of-support dates for these versions. Exchange 2016 reached the end of its mainstream support in October 2020, while Exchange 2019's mainstream support concluded in January 2024.
Despite previous assurances that no further extensions would be granted, the Exchange Server team acknowledged customer inquiries regarding additional support. In a recent blog post, they clarified that the current "Period 2" ESU program, which is now at its midpoint, will be the final offering. "There will be no further extension of Exchange 2016/2019 ESU program timeline," the team stated. "Once October 2026 ends, there will be no further updates for Exchange 2016/2019, even if you currently have a Period 2 ESU."
Microsoft is strongly advising IT administrators to proactively upgrade or migrate their Exchange environments. The recommended path for organizations running Exchange Server 2019 is an in-place upgrade to Exchange Server Subscription Edition (SE), a process described as being identical to applying a Cumulative Update (CU). This approach aims to minimize disruption and leverage existing infrastructure.
For those still operating Exchange Server 2016 or even older versions like Exchange 2013, Microsoft recommends a direct upgrade to Exchange Server SE. Alternatively, administrators can first upgrade to Exchange Server 2019 and then proceed to SE. This staged approach offers flexibility for organizations with more complex or outdated infrastructures.
Beyond on-premises solutions, Microsoft is also guiding customers toward its cloud-based offerings. Detailed migration guidance for Microsoft 365 is available on Microsoft's official documentation site. This includes comprehensive instructions for moving to Exchange Online, which is accessible as a standalone service or as part of various Office 365 subscription plans. The company is encouraging a swift transition to cloud services to ensure continuous security and access to the latest features.
The end of support for Exchange 2016 and 2019 is part of a broader trend by Microsoft to consolidate its server products and encourage migration to cloud-based or subscription models. This move aligns with the company's strategic focus on security, scalability, and feature velocity, which are more readily achieved with modern, cloud-native architectures. Organizations delaying this migration risk facing significant security vulnerabilities and operational challenges as unsupported software becomes an increasingly attractive target for attackers.
As the October 2026 deadline approaches, organizations must prioritize their migration strategies. Failure to do so could result in compromised email systems, data breaches, and significant business disruptions. The clear message from Microsoft is that the era of supporting these older Exchange versions is definitively over, and proactive planning is essential for continued security and operational continuity.