# Microsoft Declares Exchange Server 2016 and 2019 Permanently Vulnerable Microsoft ends all security support for legacy Exchange versions, urging immediate enterprise migration. - **Source:** [The Register](https://www.theregister.com) - **Published:** 2026-11-12 - **Topic:** [technology](https://brifing.si/c/technology) - **Original article:** - **On Brifing:** https://brifing.si/s/116a493a-87e7-4dd6-85f2-3cf8acc2130b ## Legacy Software Security Abandonment Microsoft has officially designated Exchange Server 2016 and 2019 as permanently vulnerable systems. The company confirmed that these legacy versions are no longer being tested for security flaws. Organizations still operating these platforms face significant risks, as no further patches or updates will be developed to address emerging cyber threats. ## End of Support Timeline Standard support for these Exchange versions concluded on October 14, 2025. Although Microsoft introduced an Extended Security Updates program to bridge the gap, the final deadline was strictly enforced. Despite previous extensions, the company has now ceased all maintenance, leaving remaining users without a safety net for their critical server infrastructure. ## November Update Exclusions The latest November security release exclusively targets the Subscription Edition of Exchange Server. While this update addresses nine distinct vulnerabilities, including a critical remote code execution flaw identified as CVE-2026-118207, earlier versions remain entirely excluded. Microsoft explicitly stated that they are no longer conducting vulnerability testing for the 2016 and 2019 iterations. ## Failed Migration Expectations Microsoft initially hoped customers would transition to newer versions or cloud-based alternatives by April 2026. When many organizations failed to migrate, the company provided a final six-month extension for paid security updates. This grace period has now expired, marking the definitive end of the road for these specific legacy server deployments. ## Operational Risks for Enterprises Continuing to run unsupported Exchange versions exposes organizations to unpatched exploits. Because Microsoft no longer monitors these versions for vulnerabilities, any discovered flaws will remain open indefinitely. This creates a dangerous environment where attackers can leverage known remote code execution techniques against servers that lack the necessary defensive security patches. ## Windows Server Update Conflicts The final weeks of support were complicated by technical instability, notably a Windows Server update that disrupted Exchange Server functionality. These compatibility issues highlighted the fragility of maintaining legacy software in modern environments. Such incidents underscore the difficulty of keeping outdated systems operational while simultaneously managing updates for the underlying server operating systems. ## Forced Migration Strategy The shift toward the Subscription Edition represents Microsoft's broader strategy to standardize enterprise software environments. By removing support for older versions, the company effectively forces organizations to modernize their infrastructure. This transition is intended to ensure that all active deployments receive consistent security coverage and benefit from the latest architectural improvements. ## Immediate Action Required Organizations still clinging to Exchange 2016 or 2019 must prioritize an immediate upgrade to the Subscription Edition or a cloud-based alternative. With no further reprieves or security testing planned, the risk of data breaches or system compromise is high. Administrators should treat these servers as compromised assets until a full migration occurs. ## Sources covering this story - https://www.theregister.com/saas/2026/11/12/microsoft-exchange-server-2016-and-2019-enter-their-permanently-vulnerable-era/5309401 — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._