If your business still runs Microsoft Exchange Server 2016 or Exchange Server 2019 on-premises, two separate issues are converging on the same deadline this month.
Exchange Server 2016 and 2019 will stop receiving any further security updates — including under Microsoft’s paid Extended Security Update (ESU) program — by the end of October 2026. Separately, Microsoft has already patched a critical authentication-bypass vulnerability, CVE-2026-62911, that lets an attacker hijack mailboxes on unpatched Exchange 2016, 2019 and Subscription Edition servers. Any business still on Exchange 2016 or 2019 needs to confirm it is patched now and have a migration plan in place before the end of the month.
What is CVE-2026-62911?
CVE-2026-62911 is an authentication-bypass-by-capture-replay vulnerability in Microsoft Exchange Server. It lets an attacker who already has some low-level network access capture and replay credentials to take over a mailbox — reading email, downloading attachments and sending messages as that user. The flaw carries a CVSS score of 8.0 (Network attack vector, low complexity, low privileges required, user interaction required, high impact to confidentiality, integrity and availability).
Microsoft fixed CVE-2026-62911 in its August 2026 security updates, confirmed on Exchange Server’s own Microsoft Support pages. The vulnerability affects Exchange Server 2016 builds before Cumulative Update 23, Exchange Server 2019 builds before Cumulative Update 14 or 15, and Exchange Server Subscription Edition RTM builds before Microsoft’s August fix — so an unpatched server on any of those versions is exposed.
Bleeping Computer reported that, as of early September 2026, active exploitation of CVE-2026-62911 had not been confirmed — but the Netherlands’ National Cyber Security Centre (NCSC-NL) warned that working exploit code for the flaw was already circulating publicly, and urged administrators to install the update as soon as possible. Shadowserver Foundation scan data cited by Bleeping Computer found 21,899 internet-exposed, unpatched Exchange servers worldwide as at the end of August 2026, with the largest concentrations in the United States and Germany.
When does Exchange Server 2016/2019 support actually end?
This is where the two issues connect. Exchange Server 2016 and Exchange Server 2019 both reached the end of their regular Extended Support on 15 October 2025, according to Microsoft’s own product lifecycle pages. Since that date, only organisations paying for Microsoft’s Period 2 Extended Security Updates (ESU) program have continued to receive security patches at all — including the August 2026 fix for CVE-2026-62911 above.
Microsoft’s own support documentation for its September 2026 Exchange 2016 security update states that organisations enrolled in Period 2 ESU are eligible to receive released security updates “until the end of October 2026.” Bleeping Computer reports that Microsoft has confirmed there will be no further extension and no Period 3 ESU program. In practical terms: once October 2026 ends, Exchange Server 2016 and 2019 stop receiving security updates entirely, whether or not a business is still paying for ESU.
| Product | Regular support ended | Still patchable now? | What changes |
|---|---|---|---|
| Exchange Server 2016 | 15 October 2025 | Only via paid Period 2 ESU | No further patches after end of October 2026 |
| Exchange Server 2019 | 15 October 2025 | Only via paid Period 2 ESU | No further patches after end of October 2026 |
| Exchange Server Subscription Edition | Not applicable — current version | Yes, fully supported | Unaffected by this deadline |
How many Australian businesses are still exposed?
Shadowserver Foundation data reported by iTnews counted 382 vulnerable Exchange servers still running in Australia, and 56 in New Zealand, as at 31 August 2026 — part of the 21,899 exposed globally. The figures span Exchange Server 2016, 2019 and Subscription Edition installs that scans found still unpatched for CVE-2026-62911 at that date.
An Australian Signals Directorate (ASD) spokesperson quoted by iTnews said legacy technology that no longer receives security updates is “an easy target for malicious actors,” and urged organisations still running legacy Exchange to act — and, where a system can’t be replaced immediately, to segment networks to protect the most critical systems in the meantime.
What should you do before the end of October?
1. Confirm your Exchange Server is running Microsoft’s August 2026 security update or later, which closes CVE-2026-62911 — this matters regardless of whether the server is in or out of support. 2. Check whether your business is currently covered by Period 2 ESU, and if so, flag internally that this coverage — and all further Exchange patching — stops by the end of October 2026. 3. If you’re still running Exchange 2016 or 2019, plan the move to Exchange Server Subscription Edition (which supports an in-place upgrade from Exchange 2019) or shift mailboxes to Microsoft 365 / Exchange Online before that deadline. 4. If migration genuinely can’t happen in time, follow ASD’s advice and segment the network around the Exchange server to limit what an attacker could reach if it were compromised.
If you’re not sure which Exchange version your business is running, whether ESU applies to you, or what a migration would actually involve, our IT consulting team can check it for you and lay out the options — the initial consultation is free. Call 1300 584 007 to talk it through.
FAQs
What is CVE-2026-62911?
CVE-2026-62911 is an authentication-bypass vulnerability in Microsoft Exchange Server that lets an attacker with some existing network access capture and replay credentials to take over a mailbox. It has a CVSS score of 8.0 and affects Exchange Server 2016, Exchange Server 2019 and Exchange Server Subscription Edition builds released before Microsoft’s August 2026 security update.
Has CVE-2026-62911 been exploited yet?
As of early September 2026, Bleeping Computer reported that active exploitation had not been confirmed, though the Netherlands’ NCSC-NL warned that working exploit code was already circulating publicly. It’s urgent to patch, but not yet a confirmed active-attack situation.
When do Exchange Server 2016 and 2019 lose all security support?
Regular extended support for Exchange Server 2016 and 2019 ended on 15 October 2025. Since then, only businesses paying for Microsoft’s Period 2 Extended Security Updates program have still been receiving patches, and that coverage ends by the end of October 2026 with no further extension announced.
What should I do if my business still runs Exchange Server 2016 or 2019?
Confirm the August 2026 security update or later is installed to close CVE-2026-62911, then plan a migration to Exchange Server Subscription Edition or Microsoft 365 before paid ESU coverage runs out at the end of October 2026.
How many Australian businesses are still running vulnerable Exchange servers?
Shadowserver Foundation data reported by iTnews counted 382 vulnerable Exchange servers in Australia, and 56 in New Zealand, as at 31 August 2026, out of roughly 21,899 exposed worldwide.