Microsoft declares Exchange Server 2016 and 2019 permanently vulnerable as support ends
Microsoft has officially ended security support for Exchange Server 2016 and 2019 as of October 14, 2025, with Extended Security Updates (ESU) programs concluding in April 2026 and a final paid extension ending in October 2026. The company warns that these versions should be considered "permanently vulnerable" since no further security testing or patches will be released. The latest November 2026 security update addresses nine vulnerabilities only for Exchange Server Subscription Edition (SE), including a critical remote code execution vulnerability identified as CVE-2026-118207. Organizations still running Exchange 2016 or 2019 are urged to upgrade immediately to newer or online versions to avoid operational risk from unpatched vulnerabilities.
Entenda a falha
A vulnerabilidade
CVE-2026-118207 is a critical remote code execution flaw in Microsoft Exchange Server. Microsoft fixed it in the November 2026 security update for Exchange Server Subscription Edition (SE), one of nine vulnerabilities patched in that release. The articles do not give the attack requirements (authentication, network reach, configuration) or the CVSS score. Exchange Server 2016 and 2019 are no longer tested for vulnerabilities and get no patches, so Microsoft tells customers to treat them as permanently vulnerable. The articles do not say whether the flaw affects those versions.
Como foi descoberta
The articles do not say who found CVE-2026-118207 or how. It became public through Microsoft's Security Update Guide and the release documentation of the November 2026 Exchange Server SE security update. No exploitation in the wild is mentioned.
Explicação gerada por IA a partir da matéria e dos artigos, em 12/11/2026 13:16.
Linha do tempo
-
Microsoft declares Exchange Server 2016 and 2019 permanently vulnerable as support ends
ler a análise desta fonte ocultar
Microsoft has officially ended security support for Exchange Server 2016 and 2019 as of October 14, 2025, with Extended Security Updates (ESU) programs concluding in April 2026 and a final paid extension ending in October 2026. The company warns that these versions should be considered "permanently vulnerable" since no further security testing or patches will be released. The latest November 2026 security update addresses nine vulnerabilities only for Exchange Server Subscription Edition (SE), including a critical remote code execution vulnerability identified as CVE-2026-118207. Organizations still running Exchange 2016 or 2019 are urged to upgrade immediately to newer or online versions to avoid operational risk from unpatched vulnerabilities.