# Microsoft Declares Exchange 2016 and 2019 Permanently Vulnerable Organizations must upgrade immediately as Microsoft ceases all security testing for legacy Exchange servers. - **Source:** [www.theregister.com - Articles](https://www.theregister.com) - **Published:** 2026-11-12 - **Topic:** [technology](https://brifing.si/c/technology) - **Original article:** - **On Brifing:** https://brifing.si/s/a8bc6c22-165a-46a7-8270-0be971aaa815 ## End of Security Support Microsoft has officially designated Exchange Server 2016 and 2019 as permanently vulnerable systems. This classification follows the cessation of all security testing and patch releases for these legacy versions. Organizations still operating these platforms are now exposed to unpatched threats, as the company focuses exclusively on the newer Subscription Edition. ## November Update Exclusions The latest November security update documentation explicitly excludes Exchange 2016 and 2019 from receiving protection. While the Subscription Edition received fixes for nine distinct vulnerabilities, including the critical remote code execution flaw CVE-2026-118207, older versions remain ignored. Microsoft confirmed they are no longer testing these legacy environments for emerging security risks. ## Failed Migration Deadlines Standard support for these versions concluded on October 14, 2025, triggering an Extended Security Updates program. Although originally scheduled to terminate in April 2026, Microsoft granted a final six-month extension due to persistent customer reliance. That grace period has now expired, leaving no further room for additional reprieves or delayed transition timelines. ## Operational Risks Escalated By labeling these servers as permanently vulnerable, Microsoft is signaling that any remaining deployments are essentially open doors for attackers. Without ongoing vulnerability testing, unknown exploits can be weaponized against corporate networks without any defensive response from the vendor. This creates a severe liability for any organization failing to migrate immediately. ## Technical Debt Consequences The transition process has been complicated by recent technical hurdles, including Windows Server updates that previously disrupted Exchange functionality. These compatibility issues highlighted the fragility of maintaining legacy software in modern, evolving IT ecosystems. Organizations must now prioritize a complete migration to the Subscription Edition to restore a secure, supported operational baseline. ## Urgency of Immediate Upgrades Microsoft has issued a clear directive for all remaining users to upgrade their infrastructure immediately. The company emphasized that no further extensions will be granted, regardless of customer requests. This firm stance underscores the necessity of moving away from legacy software that no longer meets modern security standards or compliance requirements. ## Security Landscape Shifts The exclusion of older versions from the November patch cycle marks a definitive shift in Microsoft's lifecycle management strategy. By focusing resources on the Subscription Edition, the vendor aims to streamline security delivery. This leaves legacy users with the sole option of upgrading to maintain a defensible and stable communication environment. ## Strategic IT Implications The permanent vulnerability status serves as a critical warning for enterprise IT departments managing legacy debt. Organizations must now reconcile the costs of immediate migration against the high risks of maintaining unpatched, exposed servers. Moving forward, the focus must remain on adopting supported versions to ensure long-term stability and data protection. ## Sources covering this story - https://www.theregister.com/saas/2026/11/12/microsoft-exchange-server-2016-and-2019-enter-their-permanently-vulnerable-era/5309401 — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._