If your Kent business is still running Exchange Server 2016 or 2019 on-premises, 10 September 2026 marks a critical milestone you cannot afford to ignore.
Microsoft released the September 2026 security updates addressing vulnerabilities that affect Exchange Server
, but
Exchange Server 2016 and 2019 are out of support, and only customers who enrolled in the Period 2 Extended Security Update (ESU) programme are eligible to receive security updates released between May and October 2026
.
For SMEs across Kent and the South East still operating these legacy mail servers, the clock is now ticking toward a hard deadline in October 2026 when even ESU protection ends completely. After that date, any business running Exchange 2016 or 2019 will be operating unpatched email infrastructure—a position no UK SME can afford given the current threat landscape where Business Email Compromise has overtaken ransomware as the top financial threat.
Exchange Server 2016 and 2019 ESU Timeline: What Kent SMEs Must Know
Microsoft has released Security Updates for Exchange Server SE, with Exchange Server 2019 and 2016 ESU updates only
. The architecture is now clear: organisations running current-generation Exchange Server SE receive full ongoing support, while legacy versions receive only time-limited security patches for customers who paid for ESU coverage.
The September 2026 updates include fixes for vulnerabilities discovered through Microsoft’s internal processes and responsible disclosure from security partners.
Exchange Online customers are already protected from the vulnerabilities addressed by these SUs and do not need to take any action other than updating any Exchange servers or Exchange Management tools workstations in their environment
. On-premises customers, however, must manually deploy patches—and after October 2026, no patches will be available at any price for Exchange 2016 and 2019.
Why This Matters for UK SME Email Security Right Now
Email remains the primary attack vector for UK businesses. Unpatched Exchange servers present multiple risks:
- Remote code execution vulnerabilities that allow attackers to take complete control of your mail server
- Privilege escalation flaws enabling threat actors to gain administrative access
- Information disclosure bugs that leak sensitive business and customer data
- Compliance failures as cyber insurance and regulatory frameworks increasingly require current, supported software
- Business Email Compromise attacks that exploit known Exchange vulnerabilities to intercept invoices and payment instructions
Given that supply chain cyber attacks on UK SMEs have doubled to 18% in 2026, a compromised Exchange server can become the entry point for attacks on your customers, suppliers, and partners—multiplying legal and reputational exposure.
Three Options for Kent SMEs Before October 2026 ESU Deadline
Microsoft recommends that organisations still running Exchange 2016 or 2019 upgrade to Exchange SE as soon as possible
. Kent businesses have three practical paths forward, each with different cost, complexity, and timeline implications.
Option 1: Migrate to Microsoft 365 (Exchange Online)
For most SMEs with 5–250 users, moving to Exchange Online within Microsoft 365 represents the most sustainable long-term solution. Benefits include:
- Automatic security updates with no patching windows or server downtime
- Built-in Microsoft Defender for Office 365 protection (now included in E3 licences as we covered in August 2026)
- Elimination of on-premises hardware refresh cycles, power costs, and backup infrastructure
- Improved business continuity and remote access compared to single-server on-premises deployments
- Compliance with the UK Cyber Security and Resilience Bill requirements coming into force
Migration timelines typically run 4–8 weeks depending on mailbox count, complexity of public folders, and integration with line-of-business applications. Given we’re now in mid-September 2026, businesses starting planning this week can complete migration before the October ESU deadline.
Option 2: Upgrade to Exchange Server SE (Subscription Edition)
Organisations with regulatory, technical, or business requirements for on-premises email can upgrade to Exchange Server SE. This edition operates on a subscription licensing model similar to Microsoft 365 but keeps mail infrastructure under direct organisational control.
Exchange Server SE receives ongoing cumulative updates and security patches. However, you must still manage server hardware, Windows Server patching (including the 973 vulnerabilities fixed in September 2026 Patch Tuesday), backup infrastructure, and high availability architecture. For many Kent SMEs, total cost of ownership over three years exceeds Microsoft 365 when you account for IT time, hardware, and facilities costs.
Option 3: Hybrid Architecture (Not Recommended for Most SMEs)
Some organisations deploy hybrid Exchange configurations with mailboxes split between on-premises and cloud. While technically supported, hybrid adds significant management complexity and typically makes sense only for enterprises with specific compliance requirements or very large (500+ user) phased migrations already in progress.
Immediate Actions for Kent SMEs Running Exchange 2016 or 2019
If you’re still operating Exchange Server 2016 or 2019 in September 2026, take these steps this week:
- Audit your current Exchange environment — Determine exact version, patch level, and mailbox count.
Microsoft recommends using the Exchange Server Health Checker script to inventory your Exchange Servers and determine which updates are needed, as running this script will tell you if any servers are behind on updates
. - Document integration dependencies — Identify applications, scanners, printers, and business systems that send email through your Exchange server. These will need reconfiguration during migration.
- Assess migration paths and costs — Compare Microsoft 365 subscription costs, Exchange SE licensing, and migration project expenses against the business and security risk of continuing on unsupported software.
- Establish a migration timeline — October 2026 is the hard deadline for ESU support. Build a project plan that completes migration, testing, and cutover with time to spare.
- Engage qualified support — Exchange migration carries risks including email downtime, data loss, and broken integrations. Work with IT professionals who have documented Exchange Online migration experience.
What Happens If You Miss the October 2026 Deadline
Businesses that reach November 2026 still running Exchange 2016 or 2019 will face several immediate problems:
- No security patches for newly discovered vulnerabilities (and given AI-powered vulnerability discovery is driving record patch volumes in 2026, new Exchange flaws are inevitable)
- Cyber insurance policy violations—most UK insurers now explicitly exclude coverage for unsupported software
- Potential regulatory penalties under GDPR if a breach occurs through a known, unpatched vulnerability
- Reputational damage if your mail server is compromised and used to attack customers or partners
- Increased migration urgency and cost as you’ll be forced to migrate during an active security incident
Why Meridian Micro Recommends Microsoft 365 for Most Kent SMEs
After supporting Kent businesses through multiple Exchange migration waves since 2008, our recommendation for most SMEs is clear: migrate to Microsoft 365 before the October 2026 ESU deadline. The combination of automatic security updates, included advanced threat protection, elimination of server hardware, and predictable monthly costs makes cloud email the most sustainable option for organisations with under 250 users.
We recognise that some businesses have legitimate technical or regulatory requirements for on-premises infrastructure. For these organisations, Exchange Server SE represents a supported path forward—but it requires commitment to ongoing server management, patch deployment, and infrastructure investment that most SMEs would rather direct toward business growth.
The September 2026 security updates represent one of the final patch deliveries for Exchange 2016 and 2019. If your Kent business is still running these versions, now is the time to finalise your migration plan and begin execution. The October deadline is firm, and the security and business risks of running unpatched email infrastructure are simply too high.
Is your Kent business still running Exchange Server 2016 or 2019 with the October 2026 ESU deadline approaching? Meridian Micro has migrated hundreds of Kent SMEs to Microsoft 365 and can assess your environment, plan your migration, and execute the transition with minimal disruption to your business. Call our Saltwood office on 01303 883111 or email support@meridian-micro.com to schedule your Exchange migration assessment this week.