Exchange Server on-premises: 17 proven exploited flaws, out of support since October 2025

The CISA catalogue of known exploited vulnerabilities holds 17 entries for Exchange Server, and 13 of them carry the marker for use in ransomware campaigns. The most recent entry was added on 13 April 2026. Exchange Server 2016 and 2019 have had no public security updates since 14 October 2025. Both of those things are true at the same time, and that is the whole problem.

What is actually in the list

The CISA KEV catalogue applies an entry condition no other list uses: exploitation must be observed, not theorised. As of 19/08/2026, 17 of its entries touch Exchange Server. Five carry a CVSS score of 9.8. Eleven are rated high. One is rated medium — and that one carries the ransomware marker too.

The newest CVE year in that table is 2024, which is easy to misread as “this is history”. It is not. The entry added most recently — on 13 April 2026 — is a flaw from 2023. CISA only had the evidence in 2026. Old holes do not stop being used; they stop being talked about.

Why this particular server

An Exchange server is rarely a leaf node. It authenticates against the directory, it holds credentials, and it is usually reachable from outside because that is what a mail server is for. Germany’s federal cyber-security agency, the BSI, wrote on 28 October 2025 that a successful attack on such a server can lead to full compromise of the network, and that once a new flaw becomes known in an unsupported version, shutting the application down is normally the only remaining protection for the rest of the estate.

In the same statement the BSI put a number on it: more than 30,000 Exchange servers in Germany were still running 2016, 2019 or older versions with Outlook Web Access openly reachable from the internet — in companies, hospitals, schools, municipal utilities and local government. Its deputy president called running software that no longer receives security updates, after ample warning from the vendor, plainly negligent.

What ended on 14 October 2025

Exchange Server 2016 and Exchange Server 2019 both follow Microsoft’s fixed lifecycle policy, and both reached the end of extended support on that day. Microsoft’s own announcement that day lists what stops: bug fixes, security fixes, and time zone updates. The servers keep running. Nothing on them changes. That is exactly why the date slides past so many estates without anyone noticing.

There is a paid bridge, and its history is worth knowing. In May 2024 Microsoft stated flatly that there would be no extended support and no Extended Security Updates for either version. In July 2025 it announced an ESU programme after all: six months, October 2025 to 14 April 2026, and explicitly not to be extended. On 15 April 2026 Microsoft announced a second period running from May to the end of October 2026, with the sentence: there will be no further extensions of this programme after that.

Three details of that programme decide whether it is available to you at all. Period 2 is aimed at customers with a Microsoft Enterprise Agreement, and it has to be purchased again even by those who already held Period 1. Any updates released under it are delivered privately to enrolled customers — since October 2025 Exchange 2016 and 2019 security updates no longer appear on the public Download Center or on Windows Update. And Microsoft does not commit to releasing any updates during the period at all.

Three routes if the cloud is not an option

Route one: Exchange Server SE. This is the only path that keeps Exchange itself supported. It was released on 1 July 2025 and runs under the modern lifecycle policy, which means it has no published end date at all — of the eleven Exchange support cycles patchletter records, ten have expired and this is the one that has not. From Exchange 2019 CU15 the move is an in-place upgrade that Microsoft describes as identical to installing a cumulative update. From Exchange 2016 there is no such shortcut: you need a side-by-side upgrade onto new infrastructure. The licensing is the part that catches people out — SE uses the same model as SharePoint Server Subscription Edition and requires subscription licences, or licences with active Software Assurance, for both server and user licences. The free hybrid server licence via the Hybrid Configuration Wizard is the one exception.

Route two: buy time, with a fixed wall. The ESU programme covers exactly Exchange 2016 CU23 and Exchange 2019 CU14 or CU15, and Period 2 ends with October 2026. That is not a strategy, it is a runway, and the runway has a published end. If you take it, the plan for what happens after it has to exist before you buy it — not after. Microsoft’s own wording on both periods is that it would rather you finished migrating than bought the extension.

Route three: leave Exchange. On-premises groupware did not end with Exchange. grommunio, for instance, describes itself as a native Exchange drop-in replacement built in Europe and states compatibility with MAPI/HTTP, EWS and ActiveSync — that is the vendor’s claim, and it needs testing against your own clients and add-ins rather than believing. Be honest about the size: this is a larger project than the SE upgrade, not a smaller one, and it moves the lifecycle problem to a different vendor rather than removing it.

What applies whichever route you take

Before any of it, find out what you actually run — including the security update, not just the cumulative update. In the Exchange Management Shell:

Get-Command Exsetup.exe | ForEach-Object {$_.FileVersionInfo}

The habitual Get-ExchangeServer | Format-List Name,Edition,AdminDisplayVersion is the trap here: Microsoft’s documentation notes that it shows the cumulative update but not the installed security update. A server can look current in that output and be months behind in reality.

Three things then apply regardless of which route you pick:

• Run Microsoft’s Exchange Health Checker script. It reports the build, detected hotfixes and configuration gaps in one pass.
• Check Extended Protection. It is enabled by default from Exchange 2019 CU14 onwards and in SE; on older builds Microsoft ships a script to turn it on. It mitigates authentication relay and man-in-the-middle attacks, and it is incompatible with SSL offloading on a load balancer — worth knowing before you enable it, not after.
• Get OWA and ECP off the open internet. The BSI’s 30,000 were counted precisely because their Outlook Web Access answered from outside.

The honest limitation

The 17 entries are a floor, not a ceiling. KEV records exploitation somebody observed and documented; a flaw that is being used quietly is not in there yet. Nor does the list say which of the 17 apply to your specific build — that depends on your version and your configuration, and only your own inventory answers it.

The BSI number has the same shape of uncertainty in the other direction. It was counted from outside, and from outside an ESU customer and an abandoned server look identical. Some of those 30,000 are being patched under contract. Nobody on the internet can tell which ones.

Whichever route you take, the mechanics are the same: something ships, and you have to notice. Exchange Server SE received its RTM build on 1 July 2025 and nine further updates up to 11 August 2026, at irregular intervals and with no cumulative update in Microsoft’s build table yet. patchletter emails you when a new Exchange build appears — pick it on the Exchange Server product page. Free, no account, one-click unsubscribe. The current exploitation state is on the CVE page.

patchletter figures from our own dataset as of 19/08/2026: 17 KEV entries for Exchange Server, 13 with a ransomware marker, most recent addition 13/04/2026; 11 recorded support cycles, 10 of them expired. Severity from the NVD, exploitation evidence and ransomware marker from CISA. Lifecycle dates, ESU conditions, build numbers and Extended Protection from Microsoft Learn and the Exchange Team blog; the server count and the quoted assessment from the BSI press release of 28/10/2025. All external sources retrieved 19/08/2026.