Windows Server 2012 gets its last update today, and Exchange 2016 and 2019 follow on October 31

Today’s Microsoft release is the last one for several products that are still running in a lot of server rooms. Once it installs, nothing more is coming for Windows Server 2012 and 2012 R2, even for companies that paid for Extended Security Updates.

Exchange Server 2016 and 2019 follow at the end of the month.

After today, every new Windows Server 2012 bug stays open for good.
The 5-Minute Cyber Brief
Don’t Miss the Policy Changes That Affect Security Decisions
Get the key CISA actions, new regulations, guidance, and risk shifts in a quick daily brief.
Email address
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.

Server 2012 gets its last paid update today

Microsoft’s ESU lifecycle table lists October 13, 2026 as the end of year three for Windows Server 2012 and 2012 R2, the final year of the program. The same table shows year one of commercial ESU for Windows 10 ending today, so Windows 10 Enterprise, Education and Pro machines need year-two coverage to keep getting fixes.

Windows 11 version 24H2 Home and Pro editions reach end of servicing with this release. Microsoft’s lifecycle page lists the end date as October 14 at 6:59 AM Pacific, which is the morning after today’s update.

The Exchange team said in July that the Exchange 2016/2019 ESU program will not be extended again: “Once October 2026 ends, there will be no further updates for Exchange 2016/2019, even if you currently have a Period 2 ESU.”

Who still runs 2012, Windows 11 24H2 Home and Pro, or Exchange 2016/2019

Old servers tend to run the things nobody wants to touch, such as line-of-business apps, file shares and print servers. From tomorrow, a fixed Windows bug that also affects 2012 will be published with no patch for 2012.

Exchange is a bigger worry, because it faces the internet by design. Companies still on 2016 or 2019 have until October 31 to move to Exchange Server SE or to Exchange Online.

Find those machines before they stop getting fixes

Pull a list of everything still on Windows Server 2012 or 2012 R2 from your inventory or Active Directory, along with the owner of each.
Check Windows 11 Home and Pro devices for version 24H2 and move them to 25H2 or 26H2. Ivanti’s Todd Schell notes that 26H2 shares a kernel with 24H2, so the move is an enablement package rather than a full reinstall.
Confirm that Windows 10 machines you plan to keep have year-two ESU licensed and activated.
For Exchange 2016/2019, set a cutover date before October 31. If you can’t make it, plan to cut internet exposure (OWA, ECP, EWS) as soon as November’s bugs are announced.

Forward this

For whoever owns our servers and email: today’s Microsoft update is the last one ever for Windows Server 2012, and Exchange 2016/2019 stop getting fixes after October 31. Can we get a list of anything still running those, with an owner and a retire-or-upgrade date for each?

Details

Windows Server 2012 / 2012 R2: ESU year 3 ends October 13, 2026. Extended Support ended October 10, 2023.
Windows 10 (Enterprise, Education, Pro in commercial use): ESU year 1 ends October 13, 2026; year 2 runs to October 12, 2027.
Windows 11 24H2 Home/Pro: servicing ends October 14, 2026, 6:59:59 AM PT. 25H2 is supported to October 13, 2027 and 26H2 to October 10, 2028.
Exchange Server 2016 / 2019: Period 2 ESU ends with October 2026; no further extension (Exchange Team, July 20, 2026).

Hunt / verify

Active Directory computer objects with operatingSystem like “Windows Server 2012*” that have logged on in the last 30 days.
Exchange servers reporting 2016 or 2019 builds in Get-ExchangeServer, and which of them publish OWA or EWS to the internet.
Windows 11 devices in Intune or your RMM still reporting version 24H2 on Home or Pro editions.

Slack paste: Last updates: Server 2012/2012 R2 ESU ends today (Oct 13), Win11 24H2 Home/Pro servicing ends today, Win10 commercial ESU year 1 ends today, Exchange 2016/2019 ends Oct 31. Action: list the boxes, name owners, set retire/upgrade dates.

Sources

George Bailey

George Bailey is the byline of the CyberExperts editorial desk, the team behind the CyberExperts Daily Brief. The desk covers vulnerabilities, breaches and security news from vendor advisories, CISA alerts and other primary sources, and links those sources in every story. Questions or corrections: [email protected].