Exchange 2016 and 2019 reach their final extended security update month

October closes the extended update period

Microsoft's 13 October 2026 security update announcement confirms that October was the final month of Period 2 Extended Security Updates for Exchange Server 2016 and 2019. Their regular support had already ended; these updates were available to enrolled customers.

Microsoft says that after October, new updates will cover Exchange Subscription Edition only. It will stop testing 2016 and 2019 for vulnerabilities, so their absence from future advisories will not establish that they are unaffected.

What administrators should do

Inventory remaining servers and management-tools installations, apply the updates available to the organisation, and plan migration to a supported service or Exchange Subscription Edition. Hybrid deployments still need their on-premises Exchange systems patched; Exchange Online's service-side protection does not update those machines.

Check the separate Windows update issue

Microsoft's 16 October notice, updated on 20 October, describes growing mail queues, OWA failures and availability problems after certain October Windows Server updates. It says the issue is separate from the Exchange security update and can also affect Subscription Edition.

For affected installations, follow Microsoft's documented RPC registry adjustment and reboot guidance, then monitor delivery. Microsoft advises keeping the Windows security updates installed.