Is Exchange Server 2016 and 2019 Still Supported? (2026)
Short answer
Exchange Server 2016 and 2019 is in paid extended support only: standard support ended on 14 Oct 2025, and paid extended support ends on 31 Oct 2026 (in less than a month). CISA’s Known Exploited Vulnerabilities catalog lists 19 vulnerabilities that affect Exchange Server 2016 and 2019, matched to its versions through NVD data.
Exchange Server 2016 and 2019 left Microsoft support on 14 October 2025, and the only security updates still available come from a paid Period 2 ESU that Microsoft says ends on 31 October 2026 with no further extension.
Legacy Technology Tracker · Status as of 16 Oct 2026. Data checked 7 Oct 2026; refreshed monthly, with quarterly snapshots kept unchanged.
Risk rating
High: paid extended support ends 31 Oct 2026; 19 vulnerabilities on CISA's KEV list. How ratings work
Key facts
Every value links to its source and shows when we last checked or retrieved it. Data checked 7 Oct 2026; status as of 16 Oct 2026.
| Fact | Value | Source | Checked |
|---|---|---|---|
| Support status | Paid extended support onlyExchange Server 2016 and 2019 (same end-of-support date). Exchange Server Subscription Edition excluded. | ||
| End of mainstream support | |||
| End of standard support (security updates) | |||
| End of paid extended support | |||
| Extended support offer | Microsoft Exchange Server 2016/2019 Extended Security Update (ESU), Period 2 (vendor), until 31 Oct 2026 | ||
| Known exploited vulnerabilities (CISA KEV) | 19 CVEs all time; 2 added in the last 24 monthsNewest added 15 May 2026Scoped to these versions through NVD product (CPE) data. Scoped via NVD CPE. | ||
| Job postings and salaries | Not tracked for this entry | — | — |
Versions in scope
Exchange Server 2016 and 2019 (same end-of-support date). Exchange Server Subscription Edition excluded. Dates per version, each with its source.
| Version | Status | Standard support ends | Extended support ends | Latest release | Source | Checked |
|---|---|---|---|---|---|---|
| Exchange Server 2016 | Paid extended support only | 15.1.2507.61 (14 Oct 2025) | ||||
| Exchange Server 2019 | Paid extended support only | 15.2.1544.36 (14 Oct 2025) |
If you still run Exchange Server 2016 and 2019
The deadline is 31 October 2026, the last day of the Period 2 ESU. Microsoft says it will not extend it, and Exchange 2016 and 2019 have been out of support since 14 October 2025.
The realistic options:
- Move to Exchange Server Subscription Edition. It is in support under the Modern Lifecycle Policy and keeps mail on-premises. The upgrade path differs between 2016 and 2019, so confirm it in Microsoft's upgrade documentation before scheduling.
- Move mailboxes to Exchange Online. This removes the server version problem but changes licensing, identity and mail-flow design.
- Buy Period 2 ESU. Any ESU bought since 15 April 2026 counts as Period 2, so it can only buy time until 31 October 2026. Microsoft sells it through account teams and does not publish a price.
- Run unpatched. Not a plan for a mail server that is often internet-facing.
Check the operating system too. Exchange 2016 servers still on Windows Server 2012 or 2012 R2 lose OS patches on 13 October 2026 (Exchange 2019 runs only on Windows Server 2019 or later), and Microsoft does not support upgrading the Windows Server version in place with Exchange installed.
Related pages: legacy system modernization companies for migration suppliers and cost ranges.
Frequently asked questions
Is Exchange Server 2016 or 2019 still supported?
No. Microsoft's lifecycle page lists extended support as ended on 14 October 2025 for both versions. A paid Extended Security Update (ESU) programme continues to supply security updates until 31 October 2026, but it does not restore support cases.
When does the Exchange 2016 and 2019 ESU end?
Microsoft's Exchange team says Period 2 runs from May 2026 through the end of October 2026, and that there will be no further extensions. It covers Exchange 2016 CU23 and Exchange 2019 CU14 or CU15, and Microsoft does not commit to releasing any update.
Is it safe to keep running Exchange 2016 or 2019 after October 2026?
After 31 October 2026 Microsoft lists no further security updates for either version. Exchange servers often accept connections from the internet, and CISA's Known Exploited Vulnerabilities catalogue already includes Exchange Server entries, so an unpatched server carries real exposure.
What can replace Exchange 2016 or 2019?
Exchange Server Subscription Edition, Microsoft's current on-premises release, which follows the Modern Lifecycle Policy, or a move to Exchange Online in Microsoft 365. Microsoft's own ESU announcement names migration to Subscription Edition as the intended path.