Exchange Server 2016/2019 Reach 'Permanently Vulnerable' Status After End of Support
Written by AI from the linked story. Not reviewed by an editor. How this works
Microsoft has ended all security updates for Exchange Server 2016 and 2019, meaning any newly discovered vulnerabilities will never receive patches, leaving organizations running these versions permanently exposed. Exchange servers are high-value targets historically exploited by nation-state actors and ransomware groups, making unpatched instances an acute and ongoing risk. Organizations that failed to plan and execute timely migration to Exchange Online or a supported on-premises alternative now face an untenable security posture. This situation underscores the critical importance of tracking software lifecycle dates and treating end-of-support deadlines as hard migration deadlines, not soft suggestions.
Tactical Insight
Immediate actions
- Audit your environment now to identify any Exchange Server 2016 or 2019 instances and assess their internet exposure.
- Isolate or firewall off end-of-life Exchange servers from internet-facing access while a migration plan is finalized.
- Begin an accelerated migration project to Exchange Online (Microsoft 365) or a currently supported mail platform.
Long-term improvements
- Maintain a software asset inventory that tracks vendor support lifecycle dates and flags systems approaching end-of-support 12–18 months in advance.
- Establish a formal end-of-life policy that mandates migration or decommissioning before vendor support expires.
- Budget cyclically for major platform upgrades to avoid emergency migrations driven by expiring support windows.
Detection measures
- Deploy continuous vulnerability scanning to flag unpatched or end-of-life systems across the environment.
- Monitor threat intelligence feeds for new Exchange-targeting exploits and apply compensating controls (e.g., WAF rules, network segmentation) immediately when new CVEs emerge for unsupported versions.