Microsoft has announced that it will cease providing security updates for Exchange Server 2016 and 2019 via the Extended Security Update program starting in October 2026. This means that after this cutoff, these versions will no longer receive official security patches, leaving them potentially vulnerable to new threats. The announcement serves as a reminder for customers to prepare for this change by upgrading to newer supported versions or alternative solutions. No known exploits in the wild or specific vulnerabilities are referenced in the provided information.

Once security updates end, Exchange Server 2016 and 2019 installations will no longer receive patches for newly discovered vulnerabilities, increasing the risk of compromise if attackers target unpatched flaws. This could lead to potential security breaches, data loss, or service disruption if vulnerabilities are exploited. However, no active exploits or specific vulnerabilities are currently reported.

Since Microsoft will stop providing security updates after October 2026, organizations should plan to upgrade to supported Exchange Server versions or migrate to cloud-based alternatives before this date. Continuing to run unsupported versions without security updates increases risk. Patch status is not applicable as this is an end-of-support announcement rather than a specific vulnerability with a patch. No immediate action is required other than planning for upgrade or migration.