Microsoft closes the Extended Security Updates programme for Exchange Server 2016 and 2019 on 31 October 2026. No further patches will follow, including for critical flaws, so organisations running on-premises mail need a migration plan now.
Microsoft is closing the Extended Security Updates (ESU) programme for Exchange Server 2016 and Exchange Server 2019 on 31 October 2026. After that date neither version will receive another security patch, not even for flaws rated critical.
Asked whether the programme would be extended one more time, Microsoft was unambiguous: there will be no further extension of the Exchange 2016/2019 ESU timeline. The second ESU period, announced in April 2026 as a six-month reprieve, ends here. The October 2026 Patch Tuesday release was the last security update these two versions will ever get.
The server keeps running, which is the problem
Nothing breaks on 1 November. Mail still flows, users still open Outlook, and the server behaves exactly as it did the day before. That is precisely why this deadline slips past so many organisations: there is no outage to react to. The next Exchange vulnerability disclosed after that date simply will not be fixed by the vendor, and most companies will not notice until something goes wrong.
It is also worth remembering how narrow the ESU programme always was. It covered only Exchange 2016 CU23 and Exchange 2019 CU14 and CU15. Installations sitting on an older cumulative update have been unpatched for some time already. Edge Transport servers, management tools and hybrid components all share the same end date.
What this means for businesses in Türkiye
On-premises Exchange is still common among manufacturing plants, shipping and agency firms, construction offices and logistics companies that run their own server room. For these organisations there is a compliance dimension on top of the technical one.
Article 12 of Turkish Data Protection Law No. 6698 requires data controllers to maintain an appropriate level of security to prevent unlawful access to personal data. Keeping an internet-facing mail server that the vendor no longer patches can count against a company when a breach is assessed under that obligation. Because a mail server holds the full body of corporate correspondence, the range of data exposed in an incident tends to be unusually broad.
What Kamer Bilişim recommends
- Start with an honest inventory. Write down how many Exchange servers you run, which version and cumulative update each one is on, and which services (OWA, ECP, ActiveSync, Autodiscover) are reachable from the internet. This step regularly turns up an old Exchange box that everyone assumed had been decommissioned years ago and that is still answering requests.
- Pick your migration path this week. Microsoft offers two routes: move to Exchange Server Subscription Edition (SE), or migrate to Microsoft 365 / Exchange Online. Servers on Exchange 2019 can be upgraded to SE in place, in a process that resembles installing a cumulative update. Exchange 2016 installations can either go straight to SE or pass through 2019 first.
- If you cannot make 31 October, shrink the exposure. A migration rarely finishes in a fortnight, so do not leave the server as it stands in the meantime: take OWA and ECP off the public internet and put them behind VPN, route mail through a gateway, enforce multi-factor authentication on administrative accounts, and run a restore test on your mailbox database backups.
If you are not sure which version your Exchange environment is running, or you need a realistic migration plan, we provide on-site and remote support across the Anatolian side of Istanbul. Get in touch through our contact page and we will review your current setup with you.
Source: BleepingComputer, SC Media, Messaging Architects
Source: BleepingComputer