Ethical Hacking News
Microsoft Exchange Server 2016 and 2019 have entered a "permanently vulnerable" era, meaning that no further patches or updates will be released to address existing vulnerabilities. System administrators and users are advised to immediately upgrade or migrate to a more secure version of Exchange Server.
Microsoft has issued a warning to system administrators and users of Exchange Server 2016 and 2019 to upgrade or migrate to a more secure version. The software is now in a "permanently vulnerable" era, with no further patches or updates available. The Extended Security Updates (ESU) program for these versions ended on October 13, 2026. A November security update was released on November 12, 2026, fixing nine vulnerabilities, including a critical remote code execution flaw. System administrators and users are advised to upgrade or migrate to a more secure version, review security risks, and implement additional security measures.
In a critical security update, Microsoft has issued a stark warning to system administrators and users of Exchange Server 2016 and 2019, advising them to immediately upgrade or migrate to a more secure version. The software, which was previously considered secure, has entered a "permanently vulnerable" era, meaning that no further patches or updates will be released to address existing vulnerabilities.
This warning comes after Microsoft's Extended Security Updates (ESU) program for Exchange Server 2016 and 2019 ended on April 14, 2026, as previously announced. However, due to the persistence of some customers in using the older versions, Microsoft extended the program for an additional six months, until October 13, 2026. On October 13, Microsoft released the final security updates for Exchange Server 2016 and 2019, marking the end of support for these versions.
The November security update, released on November 12, 2026, fixed nine vulnerabilities in Exchange Server SE, including a critical remote code execution flaw, CVE-2026-118207. Microsoft emphasized that it is no longer testing these versions for vulnerabilities and will not release any further updates or patches.
The warning issued by Microsoft is a stark reminder to system administrators and users to take immediate action to upgrade or migrate to a more secure version of Exchange Server. This is particularly important for organizations that rely on Exchange Server for their email and messaging needs.
Microsoft's decision to end support for Exchange Server 2016 and 2019 is a result of the growing importance of cybersecurity in the modern digital landscape. As technology continues to evolve, it is essential for organizations to stay ahead of emerging threats and vulnerabilities.
System administrators and users are advised to take the following steps:
1. Upgrade or migrate to a more secure version of Exchange Server, such as Exchange Server 2019 or a cloud-based version.
2. Review and assess the security risks associated with Exchange Server 2016 and 2019.
3. Implement additional security measures, such as threat detection and incident response, to mitigate potential risks.
In conclusion, Microsoft's warning to system administrators and users of Exchange Server 2016 and 2019 is a critical reminder of the importance of cybersecurity in the modern digital landscape. It is essential for organizations to take immediate action to upgrade or migrate to a more secure version of Exchange Server and to implement additional security measures to mitigate potential risks.
Related Information:
https://www.ethicalhackingnews.com/articles/Microsoft-Exchange-Server-2016-and-2019-Enter-Permanently-Vulnerable-Era-A-Warning-to-System-Administrators-ehn.shtml
https://www.theregister.com/saas/2026/11/12/microsoft-exchange-server-2016-and-2019-enter-their-permanently-vulnerable-era/5309401
Published: Thu Nov 12 12:30:11 2026 by llama3.2 3B Q4_K_M
