Exchange 2016 and 2019: what to do now

If your business still runs its own Exchange Server 2016 or 2019, Microsoft's advice this week is blunt. It says you should consider them "permanently vulnerable" and upgrade immediately.

That's not a new flaw. It's the end of the road. The last security updates for both versions came out in October, and Microsoft has stopped even checking whether new bugs affect them.

What happened

Support for Exchange 2016 and 2019 ended on 14 October 2025. Since then Microsoft has run a paid Extended Security Update programme in two six-month stretches. The second one ran from May to the end of October 2026, and was only open to customers on an Enterprise Agreement. In October Microsoft added a note to that post: there will be no more updates for Exchange 2016 or 2019.

On 10 November Microsoft released this month's Exchange security updates. They're for Exchange Server Subscription Edition (SE) only. The same post says the two older versions are "no longer tested for vulnerabilities" and that "there are no updates released" for them.

The Register spotted the wording on Thursday. It's worth reading the Microsoft post yourself, because the important bit is the shift in tone. Until now, "out of support" still came with a safety net if you paid for it. That net has gone.

Why this matters more for Exchange than most software

An Exchange server is usually reachable from the internet. It has to be, to receive mail and to let people use Outlook on the web from home. It also holds every email the business has sent or received, and it's normally joined to your Windows domain.

So any new flaw found from now on stays open on a machine that faces the internet and knows a lot about your business. You won't get a patch, and you won't get a warning, because nobody at Microsoft is testing it.

Does it affect you?

You're in scope if your email lives on a server you (or your IT supplier) own, rather than in Microsoft 365 or Google Workspace. Some quick ways to tell:

Ask whoever looks after your IT. It's a one-line question: "Do we still have an on-premises Exchange server, and what version is it?"

Look at how people get webmail. If staff log in at something like mail.yourcompany.co.uk/owa, that's very likely your own Exchange server.

Check the version directly. On the server, the Exchange Management Shell will tell you:

Get-ExchangeServer | Format-List Name,Edition,AdminDisplayVersion

The admin centre shows the same information. Note the cumulative update (CU) as well as the version, because it decides your upgrade route.

It's also worth checking whether you moved to Microsoft 365 years ago but left an old Exchange server running for management or "just in case". Those are easy to forget, and they count.

What to do this week

1. Find out what you've got. Version, CU, and whether it's reachable from the internet. That last one shapes everything else.

2. Lock down what you can. While you plan the move, I'd restrict Outlook on the web and the admin centre so only the office network or a VPN can reach them. That's my advice rather than Microsoft's, and it won't fix anything, but it shrinks the number of people who can try.

3. Pick a destination. There are really two: keep Exchange on your own kit by moving to SE, or move your mail to the cloud (Microsoft 365 or another provider) and retire the server altogether.

If you're staying on SE, the route depends on where you start. From Exchange 2019 CU14 or CU15, Microsoft says the in-place upgrade to SE is "identical to installing a CU". On an earlier CU, update to CU15 first.

From Exchange 2016 it's a bigger job. There's no in-place route. You need to be on Exchange 2016 CU23, then do a side-by-side move to a new SE server.

4. Check the licensing before you commit to SE. Microsoft says SE needs either cloud subscription licences for all users and devices, or server licences and CALs with active Software Assurance. If you bought Exchange 2019 outright years ago without Software Assurance, budget for that.

5. Book it in. Whichever route, give it a date this month rather than "in the new year".

Look at what else talks to it

The mail moving is usually the easy part. The awkward bit is everything else that quietly uses the Exchange server: the scanner that emails PDFs, the accounts package that sends invoices, a website form, an old line-of-business app that relays mail through it. Make a list before you switch anything off.

If one of those is a bespoke system and the person who wrote it has moved on, the team at Dev Partners take on existing software and can change how it sends mail. They wrote about a very similar deadline this week, .NET 8 going out of support, and the advice is the same: unsupported doesn't stop working, it just stops getting fixed.

For the servers, this is a typical fix-up job for me. Work out what you have, decide where it's going, move it, and switch the old one off properly.