Microsoft says Exchange Server 2016 and 2019 are no longer tested for vulnerabilities and should be treated as permanently vulnerable. November's security update is for Subscription Edition only.
Microsoft says customers still on Exchange Server 2016 or 2019 should treat those versions as permanently vulnerable. The Exchange team said on November 12, 2026, that those versions are no longer tested for vulnerabilities and that no updates are being released for them. It says organizations on those versions should upgrade immediately.
The November 2026 security update is for Exchange Server Subscription Edition, including the SE RTM build. Microsoft says the fixes cover vulnerabilities reported by security partners and found in its own testing. It points administrators to the Security Update Guide for the individual entries and does not list them in the post. Exchange Online is already protected. Customers still need to install the update on any Exchange servers they run, including servers used only for management, and on workstations that run Exchange management tools.
Microsoft says customers still on Exchange Server 2016 or 2019 should treat those versions as permanently vulnerable.
Microsoft says Exchange 2016 and 2019 are out of support, and that the Period 2 extended security update program has ended. It repeats that those versions are no longer tested and that no updates are released. The instruction is to upgrade.
The November 2026 security update is for Exchange Server Subscription Edition, including the SE RTM build.
Microsoft says any version of Exchange might become unstable after the October 2026 Windows Server updates. It says the fix is to install the November 2026 Windows Server updates. A registry key created for the October issue can stay in place, but it is not required once those November Windows updates are installed. Microsoft says the Exchange update and the Windows update can be installed in either order.
If a server is on a cumulative update that this release supports, Microsoft says administrators do not need to install every earlier security update in order. Install the latest one. It recommends the update on every Exchange server and on every machine that runs only the management tools. In a hybrid setup, Exchange Online is already protected, but the update still has to go on the on-premises servers. If the authentication certificate changes after the update, Microsoft says to run the Hybrid Configuration Wizard again. Reboot after setup and confirm that Exchange services started. Microsoft does not recommend uninstalling the security updates.
Tap a lens to see what this story means for you.
Liked this? The Brief brings you the whole day in tech, verified, every morning.
Two minutes, free forever. What's in The Brief →
See what’s happening right now
The Feed runs all day — short, verified briefs the moment they break.
Open the FeedFollow @thecircuitry_
Every story we publish, as it happens. No noise between.
Reader-supported
The Circuitry is a passion project I've always wanted to build, and I love the work behind it.
Running it costs real money. APIs, hosting, time. To keep improving the site and growing this into something useful for everyone, those costs have to be covered.
Any contribution is appreciated. If not, no pressure. Thanks for reading.
Microsoft has marked Microsoft 365 business and enterprise services as degraded. The strain comes from servers that became unavailable, not from a rise in traffic, and mailbox access has been affected in the Americas.
Microsoft Frontier Company says it has worked on nearly 500 AI projects with more than 200 customers in 28 countries. Named customers include Unilever, 3M, BMW, Mastercard, Siemens, and Novo Nordisk.
IDC research commissioned by Microsoft says Frontier Firms, the top 10% on its AI maturity scale, report a 4x return on AI, against 2.7x for slow adopters. The figures are what leaders reported.
Microsoft says SQL Server linked-server connections can remain open after the October 13, 2026 update KB5127648, and that an out-of-band fix is due in the next few days.
Microsoft says devices with GSocket-related detections on Linux increased 356.2% from March through August 2026, and that the rise was not consistent from month to month.
