Microsoft Exchange Server 2016 and 2019 enter their 'permanently vulnerable' era

Microsoft just gave the final blow to anyone still hanging on to Exchange Server 2016 or 2019. In the November security update documentation for the Subscription Edition (SE), the tech giant bluntly told customers that those legacy versions are “permanently vulnerable” and will no longer be tested or patched. The message is crystal clear: upgrade now or keep your mail system exposed to the wild. As a founder who’s been running real hosting infrastructure for a decade, I’ve seen this kind of corporate sigh‑and‑extend tactic before, and it never ends well for the small‑shop that’s forced to scramble for a migration path.

Microsoft’s final warning – no more patches, no more testing

The November Exchange Server SE update fixed nine vulnerabilities, including a critical remote code execution flaw (CVE‑2026‑118207). Crucially, Microsoft made it explicit that the same level of testing is not being applied to Exchange 2016 or 2019. The release notes state: “Exchange Server 2016 and 2019 are no longer tested for vulnerabilities and there are no updates released. If you are using those versions of Exchange, you should consider them permanently vulnerable.” That’s not a suggestion; it’s a directive. For any hosting provider still offering those versions as a service, the risk profile has shifted from “manageable” to “unacceptable.”

From a risk‑management standpoint, the moment a vendor stops testing a product, you lose the ability to gauge its exposure. You can’t rely on a vendor’s security bulletins to know what’s being exploited, and you can’t claim you’re “up to date” when the vendor has stopped supporting you. The practical upshot is simple: you either migrate to a supported platform or you accept that your customers’ mail is effectively an open door.

Extended Security Updates – a short‑lived lifeline

Microsoft’s Extended Security Updates (ESU) program was introduced in July 2025, with an original end date of April 14, 2026. The promise was that customers would have a clear deadline to move to a newer Exchange version or to Microsoft’s cloud offering. When April arrived, a surprising number of organisations were still clinging to the old boxes, so Microsoft grudgingly extended the ESU for another six months, but only as a paid service.

That extension was a classic “pay‑to‑stay‑alive” move. It gave a false sense of security while the underlying product continued to age without any new testing. For independent hosting firms, the lesson is stark: relying on a vendor’s grace period is a gamble. The moment the clock runs out, you’re left with a product that is not only out of support but also untested against the latest threat landscape.

The hidden cost of “permanent vulnerability”

When Microsoft says a product is “permanently vulnerable,” it’s not just a marketing line – it’s a liability warning. Any breach that stems from an unpatched Exchange 2016/2019 instance can be traced back to the fact that the vendor has officially stopped testing it. Insurance carriers, compliance auditors, and even your own legal team will ask: why were you still running software that Microsoft has declared unsafe?

In my own operations, a single unpatched Exchange box can trigger a cascade of support tickets, forensic investigations, and lost customer trust. The cost of a breach far outweighs the effort of a migration. Even if you have a custom patching process, you’re still operating blind because Microsoft’s security updates are no longer being evaluated against those versions. That uncertainty is a business risk you can’t afford.

What this means for hosted Exchange services

Many small‑to‑mid‑size hosting providers still bundle Exchange 2016 or 2019 as part of their managed email offerings. The new Microsoft stance forces a hard decision: either retire those services or transition customers to a supported platform – whether that’s Exchange 2022, Exchange Online, or a third‑party mail system.

From a practical angle, the migration effort can be broken into three phases: inventory, migration planning, and execution. Start by inventorying every Exchange 2016/2019 server you manage, noting version, customizations, and integration points. Then map out a migration path – most customers can move to Exchange Online with minimal disruption, but some legacy apps may need on‑premises Exchange 2022. Finally, execute the migration in batches, testing each step in a staging environment before going live. The key is to avoid the “big bang” approach that often leads to downtime and angry tickets.

Why the hype around Subscription Edition (SE) matters

Microsoft’s focus on the Subscription Edition in the November update underscores a strategic shift. SE receives regular security fixes, while legacy versions are left to wither. This mirrors the broader industry trend where vendors push subscription or cloud models, promising continuous updates at the cost of perpetual licensing.

For independent providers, the lesson is to watch where the vendor’s development resources are headed. If Microsoft is pouring effort into SE and cloud services, the roadmap for on‑premises Exchange will be minimal. Align your product roadmap accordingly – either embrace the cloud, build expertise around the newer on‑premises releases, or diversify away from Microsoft mail altogether.

Actionable steps for founders and hosting operators

First, conduct an immediate audit of any Exchange 2016 or 2019 instances under your control. Flag them as “high risk” and schedule migration within the next 30 days. Second, communicate clearly with your customers: explain the “permanent vulnerability” status, outline the migration benefits, and set realistic timelines. Transparency reduces churn and builds trust.

Third, evaluate the cost of continuing to pay for ESU versus the investment needed for a migration. In most cases, the migration expense is a one‑time hit, while ESU is a recurring line item that will disappear after the final six‑month extension.

Finally, build a migration playbook that can be reused for future vendor‑driven deprecations. Document the steps, tools, and fallback procedures. When the next vendor declares a product “permanently vulnerable,” you’ll be ready to act without scrambling.

Bottom line – don’t let Microsoft’s sigh become your downfall

Microsoft’s blunt message about Exchange 2016 and 2019 is a wake‑up call for anyone still running legacy mail infrastructure. The “permanently vulnerable” label is not a marketing gimmick; it’s a concrete risk that can cripple your business if ignored. As a founder who’s spent years wrestling with production servers, I can tell you that the cost of a breach, the loss of customer confidence, and the operational nightmare of emergency patches far outweigh the effort of a planned migration.

Take the warning seriously, move your customers off the dead platform, and use this as an opportunity to tighten your security posture. In the hosting world, staying ahead of vendor end‑of‑life dates is not optional – it’s the difference between thriving and surviving.

— Allan Ali, Founder

This article was produced with AI-assisted research and editorial support. Reporting is based on the source material cited below. Sources: The Register; theregister.com; Global1.News (15 November 2026).

By Allan Ali, Global1.News