Microsoft Warns Exchange Server 2016 and 2019 Are Permanently Vulnerable After ESU Ends

What changed on November Patch Tuesday​

Neowin reported that the monthly Exchange release that shipped with Patch Tuesday covered only Exchange Server Subscription Edition (SE), the one Exchange Server SKU that is still supported. Microsoft's announcement confirms this. The November security updates (SUs) cover only Exchange Server Subscription Edition (SE), and the only build that gets them is Exchange SE RTM.

Franky's Web, a long-running Exchange blog, noted that the release closes nine vulnerabilities, one of which Microsoft classifies as „Critical.“ The same site called it the first Patch Tuesday on which only Exchange Server SE receives an update. Microsoft's build-number page lists the new release as Exchange Server SE RTM Nov26SU, build 15.2.2562.57, dated November 10, 2026.

As usual, Microsoft says Exchange Online customers are already protected from the vulnerabilities addressed by these SUs and do not need to take any action other than updating any Exchange servers or Exchange Management tools workstations in their environment.

Summary: November is the first month in which Exchange 2016 and 2019 got nothing, not even for organizations that paid for Extended Security Updates (ESU).

What "permanently vulnerable" means, and what it doesn't​

The phrase sounds alarming, so it's worth being precise. Microsoft is not saying that every Exchange 2019 server has been breached or has one specific known exploit. It is describing servicing status. Microsoft's build-number page now opens with this warning: All versions of Exchange Server other than Exchange Server SE (Subscription Edition) are out of support and are no longer serviced. They should be considered permanently vulnerable.

Here is the catch. Starting this month, a flaw that affects Exchange 2019 may never appear in an advisory as affecting Exchange 2019, because Microsoft has stopped checking. Franky's Web put it this way: the old versions are simply no longer being tested. The blog added that since Exchange SE and Exchange 2019 CU15 are technically very similar, it's likely that at least some of the vulnerabilities also exist in Exchange 2019. That is analysis from Franky's Web, not a Microsoft finding, but it's a reasonable inference. Exchange SE is essentially a rebranded continuation of the 2019 codebase.

So if your vulnerability scanner reports nothing for Exchange 2019, that doesn't mean the server is clean. It means nobody is looking.

How the ESU timeline played out​

Neowin's report places the end of support "last year," which is correct, although the dates matter. Microsoft's end-of-support roadmap says support for Exchange Server 2019 and 2016 ended on October 14, 2025. After that date Microsoft no longer provides technical support, bug fixes, security fixes or time zone updates for either product.

Customers who needed more time could buy Extended Security Updates. In a statement reported by Help Net Security, Microsoft said only customers who enrolled in the Period 2 Extended Security Update (ESU) program are eligible to receive Exchange Server 2016 and 2019 security updates released between May and October 2026. That October release really was the last one. Exchange consultant Rafael Pfister wrote at the time that it is the final update for Exchange 2016 and 2019, including under the ESU program. He also pointed out that servers running 2016 or 2019 without ESU have not received security updates since May 2026.

The last builds Microsoft lists for the old versions are:

Summary: Organizations without ESU have had no Exchange security updates since May. ESU customers stopped receiving them after October. Nobody gets them now.

Why this matters for on-premises Exchange​

Exchange has been a favorite target for years. BleepingComputer reported that since November 2021, CISA has added 20 Microsoft Exchange Server vulnerabilities to its list of actively exploited security issues, 14 of them also flagged as abused in ransomware attacks. Exchange servers usually face the internet and hold every executive's inbox. An unpatched one gets found quickly.

The newly patched issues include at least one that sounds bad. According to Franky's Web, the DoS vulnerability CVE-2026-118153 doesn't even require login. Whether that flaw also exists in Exchange 2019 CU15 is exactly the question Microsoft no longer answers.

The other November fix: it's a Windows Server update, not an Exchange one​

Neowin also reported that the November update fixed instability that has hit Exchange SE deployments since October. The symptoms were OWA failures, growing mail queues and DAG members unable to reach quorum. The symptoms are accurate, but the fix needs a correction. Microsoft's Exchange Team blog post on the problem was updated on November 10. It now says the fix is to install the November 2026 (or later) Windows Server update on the machine that hosts Exchange. Installing the Exchange SE security update alone won't fix it.

Microsoft is explicit about the cause. The problems are not related to installing any Exchange Server update, and any Exchange version running on an affected Windows Server build could be hit, including 2016, 2019 and SE. These are the October Windows Server updates Microsoft linked to the problem:

• KB5126646 – Windows Server 2025
• KB5126655 – Windows Server 2022
• KB5126651 – Windows Server 2019
• KB5126868 – Windows Server 2016

Microsoft listed these symptoms:

• OWA failing with MapiExceptionMdbOffline: Unable to make connection to the server. (hr=0x80004005, ec=1142), plus event ID 1006 in the Application log
• Mail queues growing during the day until mail flow nearly stops
• DAG members unable to reach quorum
• A reboot clearing things up for a while

If you used the October workaround, the EpmapSavedContextCap registry value under the RPC key, Microsoft says you can leave it in place. Once the November Windows Server update is installed, though, you no longer need it.

There's one important nuance. The Windows Server fix restores stability, but it doesn't make an Exchange 2016 or 2019 server supported again or give it any Exchange security fixes. A stable server that isn't patched is still unpatched.

What admins should do now​

1. Take inventory. Microsoft recommends the Exchange HealthChecker script for each server, because it shows the full build including installed SUs and hotfix updates. The quicker Get-ExchangeServer | Format-List Name,Edition,AdminDisplayVersion in the Exchange Management Shell shows only the cumulative update level, not the SU.
2. Patch Windows Server. On every Exchange host, whatever the Exchange version, install the November 2026 Windows Server update to clear the October instability.
3. Patch Exchange SE. Install Nov26SU (build 15.2.2562.57) on SE servers.
4. Plan your way off 2016 and 2019. Franky's Web notes that from Exchange 2019 CU15, the migration is possible via Inplace Upgrade This can be done quite quickly, but Exchange 2016 requires a traditional migration. Microsoft's roadmap lists Microsoft 365, Office 365 and Exchange SE as the destinations. It also reminds hybrid organizations that still manage users with Microsoft Entra Connect that they must keep at least one Exchange server for recipient management.
5. Reduce exposure while you migrate. Guidance from the Dutch NCSC, reported by BleepingComputer, says that if replacement isn't immediate, ensure that the server is accessible only internally and replace it if possible.

The bottom line​

Some Exchange admins will see this as Microsoft steering on-premises customers toward the cloud. Commenters on Microsoft's own blog have said much the same. Still, Microsoft gave plenty of warning, and Exchange SE remains a fully supported on-premises option for organizations with data-residency or regulatory reasons to keep mail in-house. The bigger risk is staying on 2016 or 2019 and assuming no news is good news.

Every month from here, Exchange SE servers will get fixes and Exchange 2016 and 2019 servers won't. Over time the 2016 and 2019 machines will carry more and more flaws that nobody has listed, let alone patched.