UPDATE July 14, 2026: Please see our release blog post for July 2026 Security Update, which, once installed, removes our recommendation to keep CVE-2026-42897 mitigation in place: Released: July 2026...
Updated Jul 14, 2026
Version 17.0
Blog Post
The mitigation was automatically applied on our Exchange Server 2019 servers and, after it was installed, we noticed that some OWA functionalities were affected (for example, inline images are no longer displayed correctly).
We also noticed the statement indicating that future Exchange 2016/2019 security updates will only be available to customers enrolled in the Period 2 ESU program. Our organization is not enrolled in either Period 1 or Period 2 ESU.
Could you please confirm whether this means we will no longer receive the required security updates to supersede/remove this mitigation, and therefore the affected functionalities will remain blocked permanently on our Exchange 2019 environment?
Nino_Bilic
Microsoft
MicrosoftYour interpretation is correct. Exchange 2019 and 2016 are not receiving any security updates unless your organization is enrolled into the ESU program. Both of those versions are out of support since October 2025. Therefore, when a permanent fix gets created for this vulnerability, E2016/E2019 customers who are not enrolled into the Period 2 ESU will not get the update (but will be able to continue using the mitigation, of course).
Curios: why not update Exchange 2019 to Exchange SE? There is literally no change in functionality (by design) - Exchange SE is a "CU16" update for Exchange 2019 as per Why “in-place upgrade” from Exchange 2019 to Exchange SE is low risk | Microsoft Community Hub. By going to Exchange SE, you are on a supported product and will get any updates going forward without any Extended Security Update contract requirements.