Exchange 2016 and 2019 get their last patch; none after November

Microsoft shipped the final security update for Exchange Server 2016 and Exchange Server 2019 on 13 October 2026. The release closes six vulnerabilities: one remote code execution flaw, four elevation-of-privilege flaws and one spoofing flaw. From the November 2026 patch cycle onward, neither version will receive another fix.

Mainstream support for both versions ended on 14 October 2025. Microsoft then ran an Extended Security Updates (ESU) programme in two periods to give organisations room to migrate. The second period opened in May 2026 and closes at the end of October 2026. Microsoft has stated plainly that there will be no third period.

Why this matters

The end of patching does not mean a server stops working overnight. The real issue is that every flaw discovered from here on will stay open. Microsoft says it will no longer test these builds and will not list them in MSRC security advisories. When the next Exchange vulnerability surfaces, there will not even be an official source to tell you whether your mail server is affected.

Exchange servers are a priority target for attackers. An internet-facing Outlook Web Access portal, deep Active Directory integration and the organisation's entire correspondence all sit on the same machine. During the ProxyLogon and ProxyShell waves, unpatched Exchange servers were the way into corporate networks. Nothing technically prevents that pattern from repeating on a build that is now permanently unpatched.

What this means for Turkish SMEs

A large share of small and mid-sized companies in Turkey still run Exchange on a physical server in their own building. For construction offices, shipping and agency firms and logistics operators, corporate mail is not just a communication channel; it is where contracts, quotations and cargo paperwork live. Those messages also contain personal data under Turkey's KVKK regime. Article 12 of Law No. 6698 requires the data controller to maintain an appropriate level of security, and keeping an unsupported, permanently unpatched mail server in production is a difficult position to defend after a breach.

There is a second practical detail this month. Following the October 2026 Windows security update (KB5126646), some on-premises Exchange servers reported OWA sign-in failures, messages stuck in the Outlook Outbox and mailbox replication errors. Any migration schedule drawn up now should account for that known issue.

What Kamer Bilişim recommends

• Start with an inventory. Which server runs which Exchange build and which CU, how many mailboxes exist, how many gigabytes have to move? If you are on Exchange 2019 CU14 or CU15, an in-place upgrade to Subscription Edition is supported. On Exchange 2016 it is not: you have to stand up a new SE server and move the mailboxes across. The two paths differ sharply in effort and cost.
• Apply the October update first, then plan the move. It is the last patch these builds can take, and skipping it leaves all six flaws open. Once it is installed, decide between migrating to Exchange Subscription Edition and moving to Microsoft 365 / Exchange Online. Licence cost, bandwidth and where you want the data to reside will drive that choice.
• Shrink the attack surface until the migration lands. Put external OWA and ActiveSync access behind an IP restriction or a VPN, enforce multi-factor authentication on administrative accounts, inspect traffic reaching Exchange at the firewall, and run an actual restore test on your mailbox backups. For every week you run unpatched, these layers are your only defence.

We can work out together which of the two paths your mail server falls into and put an inventory and migration plan on paper. We provide on-site service across the Anatolian side of Istanbul and remote support elsewhere. Reach us through our contact page.

Source: Microsoft Exchange Team Blog, Messageware, WindowsForum