Your Own Mail Server Got Its Last Security Update in October. Does That Really Matter?

"Our email works, so it must be fine." That is what most owners say about a mail server in the back room, and for years it was a fair test. It stopped being one in October. A server can deliver every message on time and still be the easiest way into your company, because email software is exactly where attackers look first, and the manufacturer has now stopped fixing what they find.

If your staff use Outlook but the mailboxes live on a physical or virtual server you own, or in a data centre you rent space in, this applies to you. If your mail already runs in Microsoft 365, it does not, with one exception covered below: the leftover server many companies forgot to switch off after moving.

Quick answers

Which versions lost support? Exchange Server 2016 and Exchange Server 2019. Regular support ended on October 14, 2025. Microsoft then sold paid extra security updates for a year, and those ended in October 2026.

Will the server stop working? No. It keeps sending and receiving mail. What stops is the supply of fixes for newly discovered security holes.

Can we just buy more time? Not from Microsoft. Its own reminder says the timeline will not be extended, even if you already paid for the second extension period.

What is the quickest safe route? For most small companies it is Exchange Online, because there is no server left to patch. If you must keep a server on site, Exchange Server Subscription Edition is the only supported version.

What exactly ended, and when?

The timeline is short but easy to misread, because Microsoft stretched it twice. Regular support for Exchange 2016 ended long ago, and for Exchange 2019 in January 2024, according to BleepingComputer's summary. Both versions were due to lose all support in October 2025. Microsoft then offered a paid Extended Security Update (ESU) programme as a bridge, and in April 2026 added a second period of six months.

That bridge has now been crossed. The Exchange team added a note to its Period 2 announcement on October 13, 2026: the final set of updates has been released and nothing further will follow. In its earlier reminder Microsoft was explicit that after October 2026 there are no further updates for Exchange 2016 and 2019, even for customers who hold a Period 2 licence.

Why does a server that works become a risk overnight?

Think of the last patch as a photograph of the server's known weak points. Every flaw found after that date is still there, and the only people who now study the code closely are people who want in. When a fix exists for a product that is still supported, attackers have to hurry. When no fix will ever exist, the flaw is a permanent door.

Mail servers are an especially bad place for that, for three reasons. They have to be reachable from the internet, or nobody could send you email. They hold the most useful data in the company: contracts, invoices, password reset messages. And they usually sit close to your internal accounts, so a break-in rarely stays in the mailbox.

There is also a quieter problem. Insurers and customers ask about supported software. A questionnaire that asks whether all software on the internet-facing edge still receives security updates has a clear answer for you now, and it is no. If you handle personal data, that answer also weakens your position under the GDPR, which expects appropriate technical measures and reads an unpatched public server as the opposite.

Do you actually still run Exchange?

This sounds like a silly question, but it is the most common surprise. In the tenants we look at, the server nobody remembers is usually one of three things:

• The real mail server. Mailboxes live on it. You will know, because your IT person patches it, or the invoice from your provider says "Exchange".
• The hybrid leftover. You moved mailboxes to Microsoft 365 years ago but kept one Exchange server to manage users, or because an old scanner and a line-of-business app send mail through it. It feels harmless because nobody logs into it. It is still an Exchange 2016 or 2019 server, and it still counts.
• The relay. A server whose only job is to let printers and applications send email. Same software, same end date.

To find out, ask your IT provider for the list of servers with the Exchange role, then check from the outside whether a sign-in page for Outlook on the web answers on your public address. If you have no provider to ask, a free external port scan of your public addresses answers the same question in a few minutes.

Which way forward fits a small company?

There are two realistic paths. Doing nothing is the third, and it belongs in the table because it is what happens by default.

For a company of 10 to 50 people we recommend Exchange Online in nearly every case. A mail server on site only makes sense when something concrete forces it, such as a regulator or a production system that cannot talk to the cloud. "We have always done it this way" is not a concrete reason.

Is Exchange Server Subscription Edition the easy option?

Sometimes. Microsoft describes moving an Exchange 2019 server to Subscription Edition as a process identical to installing a cumulative update, and servers on Exchange 2016 can go straight to it or via 2019, again per BleepingComputer. That makes it the shortest technical path.

The catch is what comes after. You still own a server that faces the internet, and you now follow Microsoft's update cycle for as long as you run it. Someone has to apply every update promptly, watch the logs and keep the operating system current. For a company with a capable IT partner that is a fair deal. For a company where "IT" is one person with ten other jobs, the server will drift again, and you will be reading a post like this one in a few years.

Check the licence side before you commit. The subscription model has its own terms, so ask for the exact figures from your reseller rather than relying on what a blog says.

What does moving to Exchange Online involve?

Less than most owners expect, and more than a weekend. The mail itself moves in batches: mailboxes, calendars and shared folders are copied while everyone keeps working, and a short cut-over changes where your mail is delivered. The work that decides whether it goes smoothly is everything around it:

• Devices and apps that send mail. Scanners, alarm systems and old software often use settings that Microsoft 365 has switched off. Our posts on SMTP basic authentication and the retirement of Exchange Web Services explain which ones fail and why.
• Security at the front door. The day your mail moves is the right day to switch on multi-factor sign-in and block old login methods, instead of copying yesterday's gaps into the cloud.
• Backup. Microsoft keeps the service running, but the data is still yours to protect. Plan backup and recovery for your mailboxes from the start.
• Old mailboxes and archives. Decide what to bring across and what to export, so you do not pay to move ten years of mail nobody opens.

Our guide to planning a Microsoft 365 migration that works covers the full sequence. For a typical 20-person company, expect planning and preparation to take longer than the actual copy.

What if you cannot move this month?

Then reduce the exposure while you plan, and write down the date you will finish. These measures do not make the server safe, they make it harder to reach:

• Take the web sign-in pages (Outlook on the web and the admin pages) off the public internet, or allow them only from known addresses or through a VPN.
• Put a mail-filtering service in front of the server, so the server never talks to unknown senders directly.
• Make sure the server has every update Microsoft released, including the October 2026 set. A last patch you did not install helps nobody.
• Require multi-factor sign-in for anything that touches the server, and remove admin rights from accounts that do not need them.
• Keep an offline, tested backup. If the server is lost, a restore that works is worth more than any rule on it.

Treat this as a bridge of weeks, not months. Each of these steps helps against known tricks, none helps against a flaw nobody has published yet. A cloud security review will tell you what else reaches that server from outside.

What does waiting cost?

We cannot give you a single number, because it depends on what the server does. We can give you the shape of it. A planned migration is a project with a price and a date. A break-in on an unsupported server is a Tuesday morning when mail is gone, customers are told to ignore messages from you, and you pay for forensic work, restoration and lost days before anyone talks about fines.

There is a smaller, certain cost as well. Every month you wait, the people who know the old server get a month closer to leaving, the hardware gets a month older, and the migration gets no cheaper. In our experience a calm migration costs less than the first emergency weekend of a rushed one.

A 30-day plan you can start today

Week 1. List every server with the Exchange role, including relays and hybrid leftovers. Install the final updates on any that remain. Decide who owns the project.

Week 2. List everything that sends or reads mail through the server: scanners, applications, mobile devices, shared mailboxes. Choose Exchange Online or Subscription Edition, with the table above as the guide.

Week 3. Set up the target, turn on multi-factor sign-in, and test with a pilot group of two or three mailboxes, including one that uses a shared calendar.

Week 4. Move the remaining mailboxes, repoint your mail delivery, and keep the old server offline but intact for a short period. Then switch it off for good. A switched-off server cannot be attacked, and an unsupported one left running can.

Anything slower is fine if you have the temporary protections from the previous section in place. Anything with no date attached is how servers end up in next year's incident report.