Exchange Server 2019 End of Life: Support Ended Oct 14, 2025, and 38 CVEs Since Were Patched Only for Paying ESU Customers

Exchange Server 2019 end of life was October 14, 2025, the same day as Exchange 2016, and as of November 13, 2026 it is over in every sense. Paid Extended Security Updates ran in two periods and shipped their final update on October 13, 2026. In between, Microsoft’s own security data lists 38 CVEs for Exchange 2019, 4 of them Critical, fixed only for customers who bought ESU.

Exchange Server 2019 end of life date, and why some pages say October 15

Microsoft’s lifecycle page puts Exchange Server 2019 under the Fixed Lifecycle Policy, for both Standard and Enterprise editions: released Oct 22, 2018, mainstream support ended Jan 9, 2024, extended support ended Oct 14, 2025. That gave the product 2,549 days of support. The page shows dates in Pacific time but stores them in UTC, and the stored end is 6:59:59 AM on October 15, 2025, so search snippets and scrapers that read the raw HTML print October 15. The Exchange team’s “ends today” post was dated October 14.

End of support removed technical support, bug fixes, security fixes and time zone updates, per Microsoft’s end of support roadmap. Installed servers keep running. As of Nov 13, 2026, 395 days have passed since the cutoff.

Dots mark the 8 dates Microsoft released ESU-only Exchange 2019 builds. Periods from the Exchange team’s ESU posts; lifecycle dates from Microsoft Lifecycle.

Exchange Server 2019 end of life extended support: the two ESU periods

Microsoft never extended the lifecycle. It sold security updates on the side. The first ESU announcement (July 15, 2025) opened sales through account teams on August 1, 2025, for six months “through April 14, 2026”, and said the period “will not be extended past April 2026”. On April 15, 2026 the team announced Period 2, running “from the start of May 2026 through the end of October 2026”. Customers enrolled in Period 1 had to “re-purchase” it. Both periods needed a Microsoft Enterprise Agreement, were not part of Software Assurance, and were priced per server by account teams. Microsoft never published a price, and we found no Microsoft page that does.

ESU updates went out privately, not through the Download Center or Windows Update, and covered only Critical and Important fixes for Exchange 2016 CU23 and Exchange 2019 CU14 and CU15. On Oct 13, 2026 Microsoft added a note to the Period 2 post: “There will be no more updates released for Exchange 2016/2019.” It also said it will “stop testing Exchange 2016 and 2019 for vulnerabilities”. Period 2 can still be bought “for a limited time”, but only to catch up to the October 2026 release.

What still gets patched: Exchange 2019 builds after end of support

Microsoft’s build number table lists 16 Exchange 2019 builds dated after Oct 14, 2025, 8 for each of CU14 and CU15, and 8 for Exchange 2016 CU23. None was public. Over the same months Exchange SE received 10 public updates, including the Nov26SU build 15.2.2562.57 on Nov 10, 2026, which has no 2019 counterpart.

The Sep26SUv2 builds are dated October 2, 2026 in Microsoft’s table. Period 1 ESU releases came in December 2025 and February 2026; Microsoft released nothing for 2019 in the other Period 1 months.

Exchange Server 2019 CU14 and CU15 end of life

CU14 (February 13, 2024) and CU15 (February 10, 2025) share the product’s Oct 14, 2025 end date. Microsoft called CU15 “the last CU we will release for Exchange Server 2019”. The two matter for another reason: they are the only 2019 builds that can be upgraded in place to Exchange SE, and the only ones ESU covered. CU13’s last update was the November 2024 v2 re-release on Nov 27, 2024, and older CUs stopped earlier. The last public builds, 15.2.1748.39 and 15.2.1544.36, are also the minimum that Exchange Online currently accepts without throttling, per the Exchange team’s enforcement post.

The CVE ledger: every Exchange 2019 vulnerability in Microsoft’s data

We downloaded all 101 monthly MSRC security update documents from Jul 2018 to Nov 2026 and counted each CVE once, in the month it first appeared, if Microsoft listed any Exchange Server 2019 build as affected. That gives 154 CVEs. 2026 has the most, 36, and every one of them came after support ended.

*2018 covers October to December only (the product shipped October 22, 2018). 2026 runs through the November 10 release, which listed no 2019 CVEs. Severity is Microsoft’s maximum rating for the 2019 products.

Read the yearly counts with care. Microsoft’s monthly documents grew sharply: the October 2026 file carries 3,557 CVE entries across all products against 430 a year earlier, so years are not like-for-like. Every Exchange CVE from November 2025 to October 2026 that lists SE also lists 2019, which fits Microsoft’s statement that SE RTM was built from 2019 CU15. What matters for a 2019 owner is where the fix went: all 38 post-support fixes shipped only in ESU builds. 6 of the 38 are remote code execution bugs.

Counts include Exchange 2016, 2019 and SE. “Exploited” is Microsoft’s own exploitation flag in the CVRF data. The full CVE list is in the CSV.

The exploited one: CVE-2026-42897

Microsoft published CVE-2026-42897, a Critical-rated cross-site scripting bug in Outlook on the web, on May 14, 2026 with the flag “Exploited:Yes”. CISA added it to the KEV catalog on 2026-05-15, pointing to the Exchange Emergency Mitigation Service. Microsoft’s update guide entry lists the fixed 2019 builds as 15.2.1748.46 (CU15) and 15.2.1544.41 (CU14), the June 2026 builds, which only ESU customers could download. A 2019 server on the last public build has a KEV-listed, exploited bug with no public patch. Across Exchange 2019’s life, Microsoft flagged 9 CVEs as exploited when it released them: CVE-2021-26855 (Mar 2021), CVE-2021-26857 (Mar 2021), CVE-2021-26858 (Mar 2021), CVE-2021-27065 (Mar 2021), CVE-2021-42321 (Nov 2021), CVE-2022-41040 (Sep 2022), CVE-2022-41082 (Sep 2022), CVE-2024-21410 (Feb 2024), CVE-2026-42897 (May 2026).

CISA KEV listings for on-prem Exchange

CISA’s catalog version 2026.11.10 (released 2026-11-10) has 19 entries for Microsoft Exchange Server. All but one list Exchange 2019 as affected in MSRC data; the exception, CVE-2020-17144, is listed only for Exchange 2010. Two were added after Exchange 2019 support ended: CVE-2023-21529, a 2023 bug added 2026-04-13 with known ransomware use, and CVE-2026-42897. Our analysis of the CISA KEV catalog in 2026 covers the wider pattern.

How to update Exchange Server 2019 now: the move to Exchange SE

Microsoft’s recommended path for 2019 is an in-place upgrade to Exchange Server Subscription Edition, released Jul 1, 2025. SE RTM was built from 2019 CU15 plus later fixes, with no features added or removed, no schema change and, per Microsoft, “No new license keys are required.” It installs like a cumulative update on CU14 or CU15. Exchange 2016 needs a legacy migration: add an SE server and move mailboxes.

• Coexistence has a deadline. The upgrade post, updated October 27, 2026, says SE CU3 (scheduled for H1 or H2 2027) will block setup in any organization that still has Exchange 2016 or 2019. Microsoft’s July 2025 SE announcement had named CU2 for that block, so check the post before you plan.
• Windows Server. CU14 and CU15 support Windows Server 2025, and Microsoft suggests building 2025 servers on CU14 or CU15 and upgrading those in place. In-place OS upgrades with Exchange installed are not supported. Dates for each Windows Server release are in our Windows Server end of life tracker.
• SE lifecycle. The lifecycle page shows SE as “In Support” with no end date under the Modern Lifecycle Policy, which requires customers to “stay current”. Microsoft has committed to support Exchange Server through at least 2035.
• Hybrid only. If you move mailboxes to Microsoft 365 but keep managing users in on-premises Active Directory, Microsoft says “you have to keep at least one Exchange server”, and recommends that it run SE.

What this means for MSPs

• Treat every 2019 box as unpatched from November 2026. November’s 9 Exchange fixes, including a Critical remote code execution bug, were listed for SE only. Microsoft says it no longer tests 2019, so “not listed” means unknown, not safe.
• Check mail flow before January 2027. Exchange Online throttles, then blocks, mail from out-of-date on-premises servers. Today the bar is the October 2025 update. Microsoft expects to raise it in January 2027 so that only SE or Period 2 ESU builds pass. Each tenant can pause enforcement for up to 90 days a year.
• Run the build check across every client. Health Checker or Get-Command Exsetup.exe gives the build. Anything below 15.2.1748.39 or 15.2.1544.36 can already be throttled if it sends mail to Exchange Online; anything older than CU14 needs a CU before it can move to SE.
• Settle licensing first. Microsoft says SE “introduces some changes to the way Exchange is serviced and licensed”, although RTM needs no new key. Confirm server and CAL terms with the client’s reseller before the in-place upgrade. Other Microsoft dates landing on the same clients are in our Microsoft end of support 2026 list.
• Patch SE monthly. SE received 10 public updates in the 395 days after 2019 support ended. Our Patch Tuesday statistics track how big those releases have become.

Frequently asked questions

Is Exchange Server 2019 end of life?

Yes. Microsoft’s lifecycle page ends extended support on October 14, 2025, for both Standard and Enterprise. Paid Extended Security Updates ran in two six-month periods and the final ESU update shipped on October 13, 2026. Microsoft now says it will stop testing Exchange 2019 for vulnerabilities. Servers keep running, but Microsoft’s build table calls them “permanently vulnerable”.

When is Exchange Server 2019 end of life?

October 14, 2025, Pacific time. The lifecycle page stores it as 06:59:59 UTC on October 15, 2025, which is why some listings show October 15. Mainstream support ended January 9, 2024. Exchange 2016 ended the same day.

Is there extended support or an ESU for Exchange 2019?

There was, and it is over. Period 1 covered October 2025 to April 14, 2026; Period 2, which had to be bought again, covered May to October 2026. Both required an Enterprise Agreement and a quote from a Microsoft account team, which handled the per-server price. Microsoft shipped 8 ESU-only releases for 2019 CU14 and CU15, the last on October 13, 2026. Buying Period 2 now only brings you up to that October 2026 release.

What is the end of life for Exchange 2019 CU14 and CU15?

The same as the product: October 14, 2025. CU15, released February 10, 2025, was the last cumulative update. The last public builds are 15.2.1748.39 (CU15) and 15.2.1544.36 (CU14), the October 2025 updates. CU14 and CU15 are the only builds that can be upgraded in place to Exchange Server SE.

Can I install Exchange 2019 on Windows Server 2025?

Microsoft says both CU14 and CU15 support Windows Server 2025, mainly so you can build on it and upgrade in place to Exchange SE. It does not support an in-place OS upgrade with Exchange installed. Windows Server 2019 itself stays in extended support until January 9, 2029, and Windows Server 2025 until November 14, 2034.

Does Exchange Server SE have an end of life date?

No fixed date. Its lifecycle page lists a Jul 1, 2025 start and “In Support” under the Modern Lifecycle Policy, which requires you to stay current. Microsoft has also committed to support Exchange Server through at least 2035. On Nov 10, 2026 SE received 9 new CVE fixes (1 Critical); Exchange 2019 was not listed for any of them.

Free to cite and republish with a link to this page.

Methodology

References

1. Microsoft Lifecycle, Exchange Server 2019. learn.microsoft.com Accessed November 2026.
2. Microsoft Lifecycle, Exchange Server 2016, 2013, 2010 and Subscription Edition. 2016, 2013, 2010, SE. Accessed November 2026.
3. Microsoft Lifecycle, Windows Server 2019 and 2025. 2019, 2025. Accessed November 2026.
4. Microsoft, Modern Lifecycle Policy. learn.microsoft.com Accessed November 2026.
5. Microsoft, Exchange Server 2019 and 2016 end of support roadmap. learn.microsoft.com Accessed November 2026.
6. Microsoft, Exchange Server build numbers and release dates. learn.microsoft.com Accessed November 2026.
7. Microsoft, Exchange Server supportability matrix. learn.microsoft.com Accessed November 2026.
8. Exchange Team, Announcing Exchange 2016 / 2019 Extended Security Update program (July 15, 2025, edited April 15, 2026). techcommunity.microsoft.com Accessed November 2026.
9. Exchange Team, Announcing Period 2 Exchange 2016/2019 ESU program (April 15, 2026, updated October 13, 2026). techcommunity.microsoft.com Accessed November 2026.
10. Exchange Team, Released: October 2026 Exchange Server Security Updates. techcommunity.microsoft.com Accessed November 2026.
11. Exchange Team, Support for Exchange Server 2016 and Exchange Server 2019 ends today (October 14, 2025). techcommunity.microsoft.com Accessed November 2026.
12. Exchange Team, Exchange Server Subscription Edition (SE) is now available. techcommunity.microsoft.com Accessed November 2026.
13. Exchange Team, Upgrading your organization from current versions to Exchange Server SE. techcommunity.microsoft.com Accessed November 2026.
14. Exchange Team, Why in-place upgrade from Exchange 2019 to Exchange SE is low risk. techcommunity.microsoft.com Accessed November 2026.
15. Exchange Team, Released: 2025 H1 Cumulative Update for Exchange Server. techcommunity.microsoft.com Accessed November 2026.
16. Exchange Team, Throttling and Blocking Email from Persistently Vulnerable Exchange Servers to Exchange Online. techcommunity.microsoft.com Accessed November 2026.
17. Microsoft Security Response Center, CVRF v3 API. api.msrc.microsoft.com Accessed November 2026.
18. Microsoft Security Update Guide, CVE-2026-42897. msrc.microsoft.com Accessed November 2026.
19. CISA, Known Exploited Vulnerabilities Catalog (JSON feed). cisa.gov Accessed November 2026.