Microsoft has reminded customers that it will stop shipping security updates for Exchange 2016 and 2019 through the Extended Security Update (ESU) program in October.
This comes after a 6-month extension announced in April 2026 to the original ESU program, which began in October after Exchange Server 2016 and 2019 reached the end of support.
Exchange 2016 reached mainstream support in October 2020, while Exchange 2019 mainstream support ended in January 2024.
“Over the last several weeks we have received several questions about possible extension of the Exchange Server 2016/2019 ESU program past October 2026,” the Exchange Server team said in a Monday blog post.
“After all, in our original Exchange 2016/2019 ESU announcement we said that there would be no extensions, but then we ended up creating a Period 2 Exchange ESU program that is scheduled to end with October 2026. We are just about at the mid-point of Period 2 Exchange ESU now.
“There will be no further extension of Exchange 2016/2019 ESU program timeline. Once October 2026 ends, there will be no further updates for Exchange 2016/2019, even if you currently have a Period 2 ESU.”
Admins advised to upgrade or migrate
Microsoft advised IT admins to upgrade to Exchange Server Subscription Edition (SE), as they can perform in-place upgrades from Exchange Server 2019, a process identical to installing a Cumulative Update (CU).
Admins who still have servers running Exchange 2016 or 2013 in production are also advised to directly upgrade to Exchange Server SE or, first, install Exchange 2019.
Detailed Microsoft 365 migration guidance is available for global admins on Microsoft’s documentation site, which also provides more information on how to migrate to Exchange Online (available as a standalone service or as an Office 365 subscription).
In June, Microsoft quietly extended the free Windows 10 Extended Security Updates (ESU) program for consumers by an additional year, allowing enrolled devices to continue receiving security updates up until October 2027.
Earlier this month, it also announced that Windows Server 2022 and Windows 11 24H2 Home and Pro editions will reach the end of support in 90 days, but will switch to extended support and continue receiving security updates.
Security teams log 54% of successful attacks and alert on just 14%. The rest move through your environment unseen.
The Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection.
