Microsoft has announced it will terminate Extended Security Update support for Exchange Server 2016 and 2019 in October 2025, marking the final end of security patches for these widely deployed email server versions. The ESU program, which provided additional security updates beyond the standard support lifecycle, will cease delivering patches after the October deadline.
Exchange Server 2016 reached end of mainstream support in October 2020, while Exchange 2019 followed in January 2024. The ESU program offered organizations additional time to plan migrations, but that grace period is now ending. Many enterprises continue running these versions due to complex migration requirements and operational dependencies.
Organizations face three primary options: upgrade to Exchange Server 2019 Cumulative Update 14 or later versions that remain in extended support, migrate to Microsoft's cloud-based Exchange Online service, or continue operating without security updates. The third option exposes organizations to known vulnerabilities that attackers actively exploit, particularly given Exchange's history as a high-value target for threat actors.
Exchange servers have been frequent targets for ransomware groups and nation-state actors, with vulnerabilities like ProxyShell and ProxyLogon enabling widespread compromises. Running unpatched Exchange servers creates significant risk, as attackers quickly weaponize disclosed vulnerabilities. Organizations that delay migration will face mounting security debt and potential compliance violations.
Administrators should immediately audit their Exchange deployments, prioritize migration planning, and allocate resources for either upgrading to supported versions or transitioning to Exchange Online. Organizations unable to complete migrations before October should implement compensating controls including network segmentation, enhanced monitoring, and restricted external access to minimize exposure until migration completes.
Source: https://www.bleepingcomputer.com/news/microsoft/microsoft-exchange-2016-and-2019-esu-program-ends-in-october/