# Microsoft Exchange Server 2016 and 2019 enter their ‘permanently vulnerable’ era

- URL: https://talkfuse.com/story/microsoft-exchange-server-2016-and-2019-enter-their-permanently-vulnerable-era/
- Published: 2026-11-12T14:55:00+00:00
- Updated: 2026-11-12T15:05:23+00:00
- Original publisher: The Register
- Original article: https://www.theregister.com/saas/2026/11/12/microsoft-exchange-server-2016-and-2019-enter-their-permanently-vulnerable-era/5309401
- Topics: Software

## Key points

- Exchange 2016 and 2019 no longer receive security updates.
- Microsoft says organisations should upgrade immediately.
- November fixes addressed nine flaws in Subscription Edition.

## Summary

Microsoft has warned that Exchange Server 2016 and 2019 should be considered “permanently vulnerable”, as it no longer tests them for security flaws or issues updates. The warning accompanies November’s security fixes for Exchange Server Subscription Edition, leaving organisations on the older versions without protection from newly discovered vulnerabilities.

Support for Exchange 2016 and 2019 ended on 14 October 2025, followed by paid extended security updates that were extended by six months beyond their planned April 2026 end date. Microsoft released the final security updates for the older servers on 13 October; November’s update fixed nine vulnerabilities in Subscription Edition, including a critical remote code execution flaw, CVE-2026-118207.

---
Summarised by TalkFuse (https://talkfuse.com/). Quote the original publisher for the reporting and link this page for the summary and discussion.