Loading story…
Microsoft said the Extended Security Update (ESU) program for Exchange Server 2016 and Exchange Server 2019 will end in October 2026 with no further extension. The notice follows Microsoft's April announcement of a second ESU period, a six-month continuation after both on-premises Exchange versions had already reached end of support, confirming that customers relying on legacy deployments now face a fixed deadline for receiving security patches.
Microsoft is urging organizations to move to Exchange Server Subscription Edition (SE) or migrate to Exchange Online as support winds down. The company’s lifecycle guidance and follow-up reporting indicate that Exchange 2019 customers can perform an in-place upgrade to Exchange Server SE in a process similar to installing a cumulative update, while Exchange 2016 customers must plan a broader migration path before security coverage ends.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
Microsoft said there will be no further extension of the Extended Security Update program for Exchange Server 2016 and 2019 beyond October 2026. The company urged administrators to upgrade to Exchange Server Subscription Edition or migrate to Exchange Online or Microsoft 365.
Microsoft announced in April 2026 a six-month extension creating Period 2 of the Extended Security Update program for Exchange Server 2016 and 2019 after both products had reached end of support.
Microsoft Exchange Server 2019 reached end of support, prompting customers to rely on Extended Security Updates or migrate to newer offerings.
Microsoft Exchange Server 2016 reached end of support, after which it no longer received standard support or security updates outside the ESU program.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
bleepingcomputer.com
Open sourcetechcommunity.microsoft.com
Open sourcelearn.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft said **Extended Security Updates** for **Exchange Server 2016** and **Exchange Server 2019** will end in October 2026, closing the final support path for organizations still running those on-premises versions. The company had already ended mainstream support for both products on **October 14, 2025**, after which they stopped receiving regular security updates, bug fixes, technical support, and time zone updates; the current **Period 2 ESU** offering followed a six-month extension and Microsoft said it will not be extended again. Microsoft is directing affected customers to move to **Exchange Server Subscription Edition (SE)**, now the only supported on-premises Exchange release, or migrate to **Exchange Online** or **Microsoft 365**. Organizations running **Exchange Server 2019 CU15** can transition to Exchange Server SE through an in-place cumulative update without a new license key, while older deployments require legacy migration, and the guidance applies across on-premises, hybrid, and management-tools-only Exchange environments.
Jul 24, 2026
Microsoft has announced the end-of-life (EOL) for several widely used software products, including Windows 10, Office 2016, Office 2019, Exchange Server 2016, and Exchange Server 2019, marking a significant transition for organizations relying on these platforms. The final security updates for Office 2016 and Office 2019 will be released this month, after which these products will no longer receive security patches or technical support. Organizations are strongly encouraged to migrate to newer versions such as Office 2024 or Office LTSC 2024, which will be supported through October 2029, or to adopt Microsoft 365 Apps for ongoing feature and security updates. The end of support for Exchange Server 2016 and 2019 is closely linked to Office upgrades, with Microsoft recommending migration to Exchange Online or the subscription edition for continued security and compliance. For Windows 11, Microsoft has issued reminders that the Home and Pro editions of version 23H2 will reach end of servicing on November 11, 2025, after which they will no longer receive monthly security or preview updates. Enterprise, Education, and IoT Enterprise editions of Windows 11 23H2 will remain supported until November 2026, providing organizations with additional time to plan migrations. Users are advised to upgrade to Windows 11 24H2 or later, with automatic updates available for unmanaged devices, though some systems may be held back due to compatibility issues such as the presence of SenseShield Technology code-obfuscation drivers. The transition to newer software versions is critical to maintaining security, as unsupported products become increasingly vulnerable to emerging threats. Microsoft has also introduced new tools, such as Windows Backup for Organizations, to facilitate smoother migrations and ensure business continuity. The company emphasizes the importance of timely upgrades to minimize operational and security risks associated with unsupported software. These EOL milestones represent the culmination of nearly a decade of service for several Microsoft products, underscoring the need for proactive IT planning. Organizations that have not yet migrated are urged to act quickly to avoid exposure to unpatched vulnerabilities. The coordinated end-of-support for multiple products may require significant resource allocation and careful scheduling to ensure seamless transitions. Microsoft’s guidance and new migration tools are designed to support enterprises through this period of change, but the responsibility for timely action rests with IT leaders. Failure to upgrade could result in compliance issues, increased attack surface, and potential business disruptions. The end-of-life announcements serve as a critical reminder of the ongoing lifecycle management required for enterprise software environments.
Jun 29, 2026
Microsoft ended support for **Windows Server 2012** and **Windows Server 2012 R2** on **October 10, 2023**, leaving the platforms without further security updates, bug fixes, technical support, or refreshed online technical content. The change affects organizations still running the legacy server operating systems, which now face increased exposure if they continue operating unsupported workloads. Microsoft and national incident response guidance urged organizations to migrate to newer releases such as **Windows Server 2022** or enroll in **Extended Security Updates (ESU)** where upgrades cannot yet be completed. ESU is available at no additional cost for eligible Azure deployments, while on-premises customers must purchase it and can renew coverage annually through **October 13, 2026**.
Jul 24, 2026