Exchange 2019 Patches Just Ended. Here Is What IT Teams Need to Do This Month.
On April 14, 2026, Microsoft issued the last security patch it will ever release for Exchange Server 2016 and Exchange Server 2019. If your organization is still running either version, you are now on a server that cannot be secured — only replaced.
This is not a grace period. Extended Security Updates are over. The patch window is closed permanently.
What End of Extended Support Actually Means
Microsoft’s support lifecycle has two phases: mainstream support (new features, bug fixes, security patches) and extended support (security patches only). Exchange 2019 mainstream support ended January 9, 2024. Extended support ended April 14, 2026.
After extended support ends, Microsoft stops publishing security updates. Researchers continue finding vulnerabilities. Attackers continue exploiting them. Your server does not get fixed.
For a system that handles authentication, inbound SMTP, and in many organizations, calendar and contacts for the entire company, that is a meaningful exposure.
The Enforcement System That Is Already Running
Microsoft has a live transport enforcement system in Exchange Online that identifies “persistently vulnerable” on-premises servers and throttles, then blocks, their ability to send mail to Exchange Online. The system has been active since 2025 and covers any server that is end-of-life or significantly behind on patches.
With Exchange 2019 now permanently unpatched, servers running it will eventually trigger this system. The timeline depends on when new vulnerabilities are discovered and when Microsoft’s scanner flags your specific build. But the direction is clear: staying on Exchange 2019 is not a stable long-term posture.
Once flagged, you have 90 days to remediate before mail flow is blocked. Remediation at that point means migration — there are no more patches to apply.
What IT Teams Should Do This Month
If you are running Exchange 2016 or 2019, here are the immediate steps:
- Confirm your current build. Run
Get-ExchangeDiagnosticInfoor check the Exchange Admin Center. Know your exact version and CU level. - Apply the last available CU and SU now. Exchange 2019 CU15 with the April 2025 Security Update is the final patch set. If you have not applied it, do so immediately — it is the last protection you will get.
- Audit your hybrid configuration. Understand how your on-premises server connects to Exchange Online. Note any applications using EWS, SMTP AUTH, or Basic authentication — each of these has a 2026 deprecation deadline.
- Identify what is keeping you on-premises. For most organizations still on Exchange 2019, the answer is public folders. Audit them with Public Folder Analyzer — free, runs in under an hour, gives you the scope you need to plan migration.
- Start planning the migration now. Not next quarter. The 90-day enforcement clock starts the moment Microsoft flags your server. You do not control when that happens.
The Other 2026 Deadlines You Need to Know
Exchange 2019 reaching end of support is the headline, but it lands alongside several other Microsoft deprecations that affect hybrid environments:
- SMTP AUTH Basic auth — retired from Exchange Online in March 2026
- Legacy ActiveSync clients below EAS 16.1 — blocked from Exchange Online as of March 1, 2026
- Exchange Web Services (EWS) in Exchange Online — phased retirement begins October 1, 2026; full shutdown April 2027
If your environment touches any of these — and most hybrid environments do — the window to act without disruption is narrowing.
The Path Forward
For most organizations, migration to Exchange Online is the right answer. For those with regulatory or operational reasons to stay on-premises, Exchange Server Subscription Edition (Exchange SE) is the current supported version.
Either way, the migration off Exchange 2019 is not optional — it is a matter of when, and whether you control the timing or Microsoft’s enforcement system does.
Priasoft’s Migration Suite for Exchange handles Exchange-to-Exchange and Exchange-to-Office 365 migrations including cross-forest, inter-org, and hybrid scenarios. Speak with an engineer about your environment, or start with a free trial download.
Ready to Talk Through Your Migration?
Priasoft has been handling Exchange and Microsoft 365 migrations since 1999. Whether you're scoping a new project or recovering from a stalled one, our engineers have seen it before. No sales pitch — just a working conversation with people who have done this work at scale.
