Exchange 2016 and 2019 Lose ESU Patches in October

Microsoft reminded customers this week that it is ending Extended Security Update support for Exchange 2016 and Exchange 2019 in October 2026. That is the last security patch program covering these products. After it ends, Microsoft ships nothing for them — not for newly discovered RCEs, not for actively exploited zero-days, not for anything.

Exchange is not a low-risk product to run unpatched. ProxyLogon and the chain of Exchange Server vulnerabilities it anchored in 2021 established the exploitation model clearly: unauthenticated attackers, mass scanning, webshells, and persistent access at scale. Nation-state actors and ransomware groups have Exchange playbooks. Unpatched Exchange servers on the public internet get used — not eventually, quickly.

October is 90 days out. Here is what to do with them.

Step one: audit what you are actually running

You cannot migrate what you do not know about. Run this from the Exchange Management Shell to get the full inventory:

Get-ExchangeServer | Select Name, Edition, AdminDisplayVersion

Do not skip:

• Hybrid nodes — if you moved mailboxes to Exchange Online, you may have left Exchange 2016 servers running for directory sync. Those servers carry the full Exchange attack surface. Decommissioning a hybrid node properly requires the Exchange Server Deployment Assistant; do not just power them off and walk away.
• Edge transport servers — they sit on the perimeter handling inbound SMTP and tend to get forgotten once mail flow is stable.
• Servers behind NAT or load balancers — they still receive connections, still run Outlook Anywhere or MAPI over HTTP, still matter.

Step two: pick a migration path

Three options:

Exchange Online (Microsoft 365) — the path Microsoft is steering you toward. If your organization’s compliance posture, data residency requirements, and licensing position allow it, this removes the on-premises Exchange maintenance burden entirely. Migration complexity scales with mailbox count, custom transport rules, connectors, and third-party integrations. Start the planning phase now if you have not.

Exchange Server Subscription Edition (SE) — Microsoft’s current on-premises product on a subscription model, still receiving security updates. A supported migration path from Exchange 2016 and 2019 exists. This is the right path if you have hard requirements that keep mail infrastructure on-premises.

Stay on 2016/2019 with compensating controls — a valid choice for air-gapped environments and certain regulated deployments where migration genuinely cannot complete before October. Not a default. If this is the call, document the risk acceptance explicitly, segment Exchange at the network layer, increase monitoring coverage on Exchange-adjacent authentication and Outlook Web Access activity, and have an incident response plan drafted before October. “We ran out of time” is an explanation for an incident, not a plan for avoiding one.

Priority call

Microsoft’s patch support for Exchange 2016 and 2019 ends in October and it is not moving. Exchange Online migrations and Exchange SE upgrades are not 30-day projects at enterprise scale — they have testing cycles, change approval gates, and third-party integration work. If you are starting in late September, you are already late.

Audit now. Pick a path this week. If you are running a hybrid deployment with leftover Exchange 2016 nodes that nobody owns anymore, those are the highest-risk items on this list — get them in front of someone with authority to decommission them. The Rapid7 SharePoint machine-keys incident from this week is a reminder of what active exploitation of Microsoft server products looks like right now. Exchange without patches will be in the same risk tier by Q1 2027.