ESU | EighTwOne (821)

Vulnerability	Category	Severity	Rating
CVE-2025-64666	Elevation of Privilege	Important	CVSS:3.1 7.5 / 6.5
CVE-2025-64667	Spoofing	Important	CVSS:3.1 5.3 / 4.6

Vulnerability

Category

Severity

Rating

CVE-2025-64666

Elevation of Privilege

Important

CVSS:3.1 7.5 / 6.5

CVE-2025-64667

Spoofing

Important

CVSS:3.1 5.3 / 4.6

Exchange	SU/HU	Download	Build	KB	Supersedes
Exchange SE	4	Download	15.2.2562.29	KB5071876	KB5066366
Exchange 2019 CU15	6	ESU Program	15.2.1748.42	KB5071875	KB5066367
Exchange 2019 CU14	9	ESU Program	15.2.1544.37	KB5071874	KB5066368
Exchange 2016 CU23	20	ESU Program	15.1.2507.63	KB5071873	KB5066369

Exchange

SU/HU

Download

Build

Supersedes

Exchange SE

15.2.2562.29

Exchange 2019 CU15

15.2.1748.42

Exchange 2019 CU14

15.2.1544.37

Exchange 2016 CU23

15.1.2507.63

Notes

Security updates are Cumulative Update level specific. You cannot apply the Exchange 2019 CU15 update to Exchange 2019 CU14. When downloading, the security update might carry the same name for different Cumulative Updates. Nowadays, Microsoft adds the KB article number as a reference, but I would still tag the file name with the CU level for archival purposes, e.g., Exchange2019-CU15-KBxxxxxxx-x64-en.exe.

Like Cumulative Updates, Security Updates are cumulative, and you only need to install the latest SU for your CU.

Suppose you have deployed Exchange Management Tools to manage your on-premises Exchange Servers or installed the tools after removing the Last Exchange Server for recipient management. In that case, it is recommended that you apply the Security Update.

On a final note, as with any patch or update, it is recommended that you apply it in a test environment before implementing it in production. However, it is not recommended to wait for regular maintenance cycles when it comes to security updates; a more agile approach is preferable, and the ratings indicate the level of urgency.

In a somewhat surprising move yesterday, Microsoft announced there will be an Extended Security Update program for Exchange Server 2016 and Exchange Server 2019. The ESU is to cater to organizations that indicate they need some more time to move away from Exchange 2016/2019. I will not comment on the fact that these organizations had a few years to get current on Exchange 2019, which would lead them to having a smooth upgrade path now to Exchange SE, or even move to Exchange Online.

Extended Security Update

You might already be familiar with ESU programs, which are common for Windows clients and Windows Server, a.o. That said, Exchange also had its share of post-lifecycle (out-of-band) updates, such as the Hafnium security updates for Exchange 2013 and even Exchange 2010. These updates were developed and made available without any obligation as some of the updates applied to products that were past their end-of-support date.

Now, the ESU program for Exchange 2016/2019 is an official extension to keep receiving published security updates for Exchange 2016/2019. To receive these, organizations can purchase a 6-month ESU for their Exchange servers. For this, they need to contact their Microsoft account manager starting August 1st, 2025. Do note that there is no guarantee that, within this period, security updates will get published, as this is entirely driven by circumstances and urgency, of course.

To make it clear: The ESU program is not an extension of support. You cannot contact support for any incident with Exchange 2016/2019 in the ESU period. That is, unless it relates to an SU that gets published during the ESU period. Thus, ESU is more for peace of mind when it comes to security, when you can live without expecting support.

The ESU period ends April 14th, 2026, 6 months after Exchange 2016 and Exchange 2019 go out of support. It is possible to get ESU after August 1st and during the 6-month ESU window. This flexibility may lead to organizations taking a gamble, waiting for SU to appear, only to get ESU when the first SU arrives. Given that corporate purchasing processes might take some time and CUs usually come with some urgency to implement, this is not something I would recommend.

I would also not recommend seeing this ESU window as an opportunity to take it easy. The support date stands, which is what most organizations find most important. So, keep migrating, whether to Exchange SE directly or via Exchange 2019 CU15, or to Exchange Online.