Your Exchange Server Security Updates Are Ending Soon: What You Need to Know

Michael Miller · 2026-07-22

Microsoft has officially reminded customers that security updates for Exchange 2016 and 2019 will stop shipping through the Extended Security Update (ESU) program this October. If you're still running these versions, this is a big deal. ### Why This Matters for Your Business Think about it: once those updates stop, any new vulnerabilities discovered in Exchange 2016 or 2019 won't get patched. That means your email system becomes a sitting duck for hackers. And let's face it, cybercriminals love going after unpatched systems. For businesses in the United States, the stakes are even higher. With strict data privacy laws and growing threats, running unsupported software isn't just risky—it could cost you serious money in fines and recovery costs. ### What's Changing in October Here's the simple version: - Microsoft will no longer release security patches for Exchange 2016 or 2019 through the ESU program. - This applies to all editions, including on-premises servers. - If you're still on these versions, you'll need to upgrade or migrate before October to stay protected. The ESU program was a temporary lifeline for organizations that couldn't upgrade right away. But that lifeline is about to be cut. ### Your Options Moving Forward So what can you do? You've got a few paths: - **Upgrade to Exchange Subscription Edition (SE)** – Microsoft's latest on-premises version. It's designed to handle modern threats and includes ongoing security updates. - **Move to Exchange Online** – Part of Microsoft 365. This is the cloud option, and it takes the burden of patching off your shoulders. - **Switch to a third-party email platform** – Some businesses are exploring alternatives like Google Workspace or other secure providers. Each option has its pros and cons. Upgrading on-premises gives you control but requires IT resources. Moving to the cloud is easier but means trusting someone else with your data. ### The Hidden Cost of Waiting Here's where it gets real. If you delay, you're not just risking a breach. You're also looking at: - **Higher upgrade costs later** – Emergency migrations are always more expensive than planned ones. - **Compliance headaches** – Regulations like HIPAA or GDPR may require you to use supported software. - **Lost productivity** – A major email outage can bring your entire business to a halt. I've seen companies put this off, only to scramble when a zero-day exploit hit. Don't be that person. ### A Quick Reality Check Let me be honest with you. Migrating email systems is never fun. It's messy, it takes time, and there's always something that goes wrong. But the alternative—running an unsupported Exchange server—is way worse. Start planning now. Get your team together, evaluate your options, and set a timeline. October will be here before you know it. ### Final Thoughts Microsoft's reminder isn't just a formality. It's a clear signal that the clock is ticking. Whether you upgrade on-premises or move to the cloud, the key is to act before the deadline. Your business depends on email. Don't let it become a liability. *Need help with the migration? Consider consulting with a Microsoft partner or an IT security specialist who understands your specific setup.*