Reported by 5 outlets
Microsoft Exchange 2016/2019 — Security Updates End in October
Why this score
- Breadth
- 2.00 / 2.0 · 5 sources
- Authority
- 1.80 / 2.0 · best outlet weight
- Severity
- 5.00 / 5.0 · CVSS + KEV signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.00 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Desk analysis
Microsoft has confirmed it will not extend the Extended Security Update program for Exchange Server 2016 and 2019 beyond October 2026, so these versions get their final security fixes that month and none after. Exchange 2016 ended mainstream support in October 2020 and Exchange 2019 on January 9, 2024, with the lifecycle record putting 2019's extended end at October 14, 2025, which makes the ESU window the only remaining source of patches. The pressure inside that window is concrete: CVE-2026-33824, a CWE-415 double free in Windows Internet Key Exchange Service Extensions rated Critical at CVSS 9.8 for unauthenticated remote code execution, was patched April 14, 2026 (KB5082198 on Windows Server 2016, KB5082123 on Server 2019) and landed in CISA's KEV catalog on August 19, 2026 as actively exploited. Exchange itself carries CVE-2026-62911, an elevation of privilege through capture-replay authentication bypass (CWE-294, tracked by ZDI as ZDI-26-538), published August 11, 2026 at CVSS 8.0 and demonstrated by Orange Tsai of DEVCORE at Pwn2Own Berlin 2026 on May 15, where three chained bugs reached code execution as SYSTEM for a $200,000 award.
The deadline matters because of what it does to the bugs, not to the calendar. Microsoft's FAQ for CVE-2026-62911 states that an attacker who exploits it can take over the mailboxes of all Exchange users, send and read mail, and download attachments, and ZDI notes the flaw chains with other vulnerabilities into SYSTEM code execution, the same end state the IKE double free reaches inside the OS on the same host. An un-migrated Exchange 2016/2019 server therefore runs two SYSTEM-class bugs on one box, one in the mail store and one in the network stack beneath it. The cadence already visible, an April advisory becoming an August KEV entry and a September 1 public PoC claiming a pre-auth chain through the Mailbox Replication Service Proxy, shows how fast a bug matures from patch bulletin to weapon, and after October every new Exchange 2016/2019 bug stays at the advisory stage permanently on servers that remain. That standing exposure, on top of a published and priced research path to SYSTEM on Exchange from a team that also took an Edge sandbox escape and a SharePoint chain at the same event, is what separates this from routine Patch Tuesday volume.
Inventory every on-prem Exchange 2016/2019 server now and plan migration to Exchange Online or Exchange Server Subscription Edition against the October deadline, treating the October release as the last fix that will ever arrive. Verify the August 11, 2026 Exchange security updates are applied and the underlying Windows hosts run KB5082198 or KB5082123 or a later rollup; until that is confirmed, apply Microsoft's mitigation for CVE-2026-33824 and block inbound UDP 500 and 4500 where IKE is unused, or restrict those ports to known peer addresses. Hunt the IKE attack using ZDI's signatures: an IKE_SA_INIT on UDP 500 or 4500 carrying the Microsoft Security Realm Vendor ID byte sequence 68 6a 8c bd fe 63 4b 40 51 46 fb 2b af 33 e9 e8, followed by a fragmented IKE_AUTH with an Encrypted Fragment payload (SKF, type 0x35), noting the four-byte non-ESP marker shifts offsets on port 4500, and treat IKEEXT service crashes as suspicious. On Exchange, the circulating PoC's chain targets MRSProxy with an authentication coercion step, so review front-end IIS logs for anomalous MRSProxy activity and session-replay patterns on servers still pending the August update.
Two developments would move this assessment. Independent validation of the CVE-2026-62911 PoC as a working pre-auth chain, or a KEV listing for the bug (MSRC marked Exploited: No on August 11), would turn a chained elevation of privilege into unauthenticated remote code execution across every unpatched server. ZDI's disclosure timeline records the vulnerability reported to the vendor on May 21, 2026, and when DEVCORE publishes its technical writeup the two companion bugs in the chain become public in detail, the same pattern that preceded the current PoC. The other thing to watch is October itself: whether the final Exchange 2016/2019 update ships on schedule, and which post-EoS bug appears first with no fix ever coming.
Timeline
-
original reporting
Microsoft Exchange 2016/2019 — Security Updates End in October
bleepingcomputer.com · 84d ago · July 22nd, 2026
Microsoft has confirmed it will not extend the ESU program for Exchange 2016 and 2019 beyond October 2026. After this date, organizations running these versions will receive no further security updates. Exchange 2016 reached mainstream support in October 2020; Exchange 2019 in January 2024.
This is a firm deadline — organizations still on-premise with these versions have approximately three months to migrate.
Action: Plan migration to Exchange Online or Exchange Subscription Edition before October 2026 deadline.
-
original reporting
CISA Warns Microsoft Internet Key Exchange RCE Flaw Is Actively Exploited
gbhackers.com · 55d ago · August 19th, 2026
Cybersecurity and Infrastructure Security Agency (CISA) has added a critical vulnerability in Microsoft Internet Key Exchange (IKE) Service Extensions to its Known Exploited Vulnerabilities (KEV) Catalog. This vulnerability, tracked as CVE-2026-33824, is currently being actively exploited. The issue is classified as a double-free vulnerability, which means it affects the memory management of Microsoft […] The post CISA Warns Microsoft Internet Key Exchange RCE Flaw Is Actively Exploited appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .
-
update from msrc.microsoft.com
Windows Internet Key Exchange (IKE) Service Extensions Remote Code Execution Vulnerability
msrc.microsoft.com · 183d ago · April 14th, 2026
Microsoft's advisory for CVE-2026-33824 was published on April 14, 2026 during the April Patch Tuesday. It describes a double free (CWE-415) in the Windows IKE Service Extensions that allows an unauthenticated attacker to execute code over the network by sending specially crafted packets to hosts with IKEv2 enabled, rated Critical with a CVSS 3.1 base score of 9.8. At publication the flaw was not publicly disclosed and showed no exploitation, with exploit code maturity recorded as Unproven, and the fix shipped as monthly rollups across all supported Windows client and server versions, including KB5083769 for Windows 11 24H2/25H2 and KB5082200 for Windows 10 21H2/22H2. The vulnerability was reported by Microsoft's internal WARP & MORSE team.
-
update from zerodayinitiative.com
CVE-2026-33824: Remote Code Execution in Windows IKEv2
zerodayinitiative.com · 174d ago · April 23rd, 2026
This TrendAI Research write-up by Richard Chen and Lucas Miller, published April 23, 2026, details the double free in ikeext.dll that Microsoft's WARP & MORSE team discovered, caused by shallow-copied blob pointers during IKEv2 Encrypted Fragment reassembly, with code execution possible under the IKEEXT service as SYSTEM. Detection guidance is to monitor UDP 500 and 4500 for an IKE_SA_INIT carrying the Microsoft Security Realm Vendor ID byte sequence 68 6a 8c bd fe 63 4b 40 51 46 fb 2b af 33 e9 e8 followed by a fragmented IKE_AUTH with an SKF payload, noting the four-byte non-ESP marker shifts offsets on port 4500.
-
update from zerodayinitiative.com
Pwn2Own Berlin 2026 - Day Two Results
zerodayinitiative.com · 152d ago · May 15th, 2026
ZDI's Day Two results post from May 15, 2026 records Orange Tsai (@orange_8361) of DEVCORE Research Team chaining three bugs to achieve remote code execution as SYSTEM on Microsoft Exchange, earning $200,000 and 20 Master of Pwn points. The post also notes DEVCORE led the event with 40.5 points and $405,000 through two days, with day-two totals of $385,750 for 15 unique 0-days.
-
update from gbhackers.com
PoC Released for Microsoft Exchange CVE-2026-62911 Pre-Auth RCE Attack Chain
gbhackers.com · 42d ago · September 1st, 2026
A public proof-of-concept (PoC) repository has garnered attention for a pre-authentication remote code execution chain targeting Microsoft Exchange Server. This repository highlights CVE-2026-62911, an Exchange authentication-bypass vulnerability disclosed following Pwn2Own Berlin 2026. Defenders should treat the published code as unverified until it is independently validated in an isolated laboratory environment.
-
update from cyberpress.org
Public PoC Released for Microsoft Exchange Pre-Auth Remote Code Execution
cyberpress.org · 42d ago · September 1st, 2026
However, defenders should treat published exploit material as unverified until it has been independently tested in a controlled, isolated lab environment. Public PoC Released for Microsoft Exchange Microsoft’s advisory and the Zero Day Initiative (ZDI) classify CVE-2026-62911 as an elevation-of-privilege vulnerability involving a capture-replay authentication bypass, not a standalone unauthenticated RCE flaw. ZDI tracks the issue as ZDI-26-538 and attributes it to improper session management in Exchange authorization. While authentication is normally required, the vulnerable mechanism can reportedly be bypassed under specific conditions. When chained with additional bugs, the weakness can contribute to arbitrary code execution with SYSTEM-level privileges. The demonstration achieved SYSTEM-level code execution and earned a $200,000 reward. The newly circulating PoC describes an attack sequence involving Exchange’s Mailbox Replication Service Proxy, or MRSProxy. It claims that an attacker could coerce NT