Technology news and discussion on TalkFuse.
Microsoft Exchange Server 2016 and 2019 enter their ‘permanently vulnerable’ era
Microsoft has warned that Exchange Server 2016 and 2019 should be considered “permanently vulnerable”, as it no longer tests them for security flaws or issues updates. The warning accompanies November’s security fixes for Exchange Server Subscription Edition, leaving organisations on the older versions without protection from newly discovered vulnerabilities.
Support for Exchange 2016 and 2019 ended on 14 October 2025, followed by paid extended security updates that were extended by six months beyond their planned April 2026 end date. Microsoft released the final security updates for the older servers on 13 October; November’s update fixed nine vulnerabilities in Subscription Edition, including a critical remote code execution flaw, CVE-2026-118207.
In short
- Exchange 2016 and 2019 no longer receive security updates.
- Microsoft says organisations should upgrade immediately.
- November fixes addressed nine flaws in Subscription Edition.
Explained simply
Exchange Server is software organisations run on their own systems to manage work email, calendars and contacts. Versions 2016 and 2019 are older editions; Subscription Edition is Microsoft’s newer version.
Microsoft provides support for its products for a set period, including testing for security problems and issuing fixes. Once support ends, organisations using an older version may have to move to a supported edition or make other arrangements to manage security risks.
These servers can hold sensitive messages and account details, so weaknesses may matter to organisations and the people who use their email. A security flaw could, depending on the flaw and the system’s setup, allow attackers to access data or interfere with the server.