[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$flLSNhoQxwjzN8SfBp_JyDdcoXqgrFBmUSCnEWX7Cwyc":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":16,"status":21,"created_at":22,"published_at":23,"article":24,"tags":28,"podcasts":41,"controls":42},"d4b86646-fc15-4926-823f-18aff2e84975","exchange-server-20162019-reach-permanently-vulnerable-status-after-end-of-support","363ee090-6e56-4921-bf2c-8bb3776b6d1d","Exchange Server 2016\u002F2019 Reach 'Permanently Vulnerable' Status After End of Support","Microsoft has ended all security updates for Exchange Server 2016 and 2019, meaning any newly discovered vulnerabilities will never receive patches, leaving organizations running these versions permanently exposed. Exchange servers are high-value targets historically exploited by nation-state actors and ransomware groups, making unpatched instances an acute and ongoing risk. Organizations that failed to plan and execute timely migration to Exchange Online or a supported on-premises alternative now face an untenable security posture. This situation underscores the critical importance of tracking software lifecycle dates and treating end-of-support deadlines as hard migration deadlines, not soft suggestions.","**Immediate actions:**\n- Audit your environment now to identify any Exchange Server 2016 or 2019 instances and assess their internet exposure.\n- Isolate or firewall off end-of-life Exchange servers from internet-facing access while a migration plan is finalized.\n- Begin an accelerated migration project to Exchange Online (Microsoft 365) or a currently supported mail platform.\n\n**Long-term improvements:**\n- Maintain a software asset inventory that tracks vendor support lifecycle dates and flags systems approaching end-of-support 12–18 months in advance.\n- Establish a formal end-of-life policy that mandates migration or decommissioning before vendor support expires.\n- Budget cyclically for major platform upgrades to avoid emergency migrations driven by expiring support windows.\n\n**Detection measures:**\n- Deploy continuous vulnerability scanning to flag unpatched or end-of-life systems across the environment.\n- Monitor threat intelligence feeds for new Exchange-targeting exploits and apply compensating controls (e.g., WAF rules, network segmentation) immediately when new CVEs emerge for unsupported versions.",[12,13,14,15],"CIS Control 2: Inventory and Control of Software Assets (v8)","CIS Control 7: Continuous Vulnerability Management (v8)","NIST SP 800-53 SI-2: Flaw Remediation","NIS2 Article 21(2)(e)",{"NIS2 Article 21(2)(e)":17,"NIST SP 800-53 SI-2: Flaw Remediation":18,"CIS Control 7: Continuous Vulnerability Management (v8)":19,"CIS Control 2: Inventory and Control of Software Assets (v8)":20},"NIS2 Article 21(2)(e) mandates security in acquisition, development, and maintenance including vulnerability handling; continuing to operate end-of-life software that cannot receive vulnerability patches is a direct failure of this obligation.","SI-2 requires organizations to identify, report, and correct information system flaws; operating a mail server for which the vendor will no longer release flaw corrections makes compliance with this control impossible without migration.","CIS Control 7 calls for ongoing vulnerability assessment and remediation prioritization; running software that will never again receive security patches is a direct violation of the continuous remediation principle this control mandates.","CIS Control 2 requires organizations to track software lifecycle status; maintaining this inventory would have surfaced the impending Exchange end-of-support date in time to plan an orderly migration.","published","2026-11-12T15:20:41.010817+00:00","2026-11-12T15:20:40.988+00:00",{"id":7,"url":25,"slug":26,"title":27},"https:\u002F\u002Fwww.theregister.com\u002Fsaas\u002F2026\u002F11\u002F12\u002Fmicrosoft-exchange-server-2016-and-2019-enter-their-permanently-vulnerable-era\u002F5309401","microsoft-exchange-server-2016-and-2019-enter-their-permanently-vulnerable-era-322862","Microsoft Exchange Server 2016 and 2019 enter their 'permanently vulnerable' era",[29,35],{"id":30,"name":31,"slug":32,"description":33,"color":34},"05757c8d-6b93-4194-b35d-7359e7d33b0e","Vulnerability Management","vulnerability-management","Missing scans, no risk prioritization","#fb923c",{"id":36,"name":37,"slug":38,"description":39,"color":40},"af7fce9e-1ce8-4156-93bc-09dcfbfdf29d","Patch Management","patch-management","Unpatched vulnerabilities, delayed updates","#ef4444",[],[43,46,49],{"slug":32,"name":44,"problem":45},"Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",{"slug":38,"name":47,"problem":48},"Automated patch management","Known holes get closed in days, not months.",{"slug":50,"name":51,"problem":52},"asset-inventory","Cyber asset inventory","You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have."]