Bottom line: The ESU program for Exchange 2016/2019 ends definitively in October 2026, with no further security updates to follow.
Microsoft will discontinue Extended Security Updates (ESU) for Exchange Server 2016 and 2019 in October 2026 and refuses further extensions. CISOs must implement their migration strategy by then.
Microsoft confirms in a statement from the Exchange development team that security updates for Exchange Server 2016 and 2019 under the Extended Security Update (ESU) program will end in October 2026. The company rules out any further deadline extension: “After the expiration of October 2026, there will be no further updates for Exchange 2016/2019, even if you currently have an ESU Phase 2 subscription.”
The ESU program began after the end of mainstream support in October 2025 and was extended with a second phase in April 2026. For Exchange Server 2016, this means all support ends four years after extended support ended (October 2020). Exchange Server 2019 receives updates approximately six years after its extended support ended (January 2024). After October 2026, systems running these versions will be indefinitely vulnerable to known vulnerabilities.
Administrators with Exchange Server 2019 can perform an in-place upgrade to Exchange Server Subscription Edition (SE), a process that corresponds technically to a cumulative update. For systems with Exchange Server 2016 or 2013, Microsoft recommends either transitioning to Exchange Server SE with an intermediate step via Exchange 2019, or switching to Exchange Online or Microsoft 365. Approximately 18 months remain for planning and implementation.
Source: www.it-daily.net · Published 23 July 2026
Lumi AI News — AI-assisted curation in accordance with Article 50 EU AI Act. Paraphrase and classification by Lumi News Pipeline v1.7.3.