Exchange 2019 CU15 SU8 EOL Oct 14, 2025 – Action Plan

What Changes on October 14, 2025?

On that date, Microsoft will stop all support for Exchange 2019 CU15 SU8. That means:

• No more security patches. Any newly discovered vulnerabilities will remain unpatched.
• No more bug fixes. Non-security issues will not be addressed.
• No vendor SLAs. Microsoft will not provide technical support for this version.

Your system will technically continue to run, but it will be exposed to unpatched security risks. Compliance auditors and cyber insurers increasingly require proof of support or compensating controls for end-of-life (EOL) software.

Inventory Affected Systems

Before you can act, you need to know exactly what you have.

• Identify every Exchange 2019 CU15 SU8 instance in your environment. Use PowerShell scripts (e.g., Get-ExchangeServer | Format-List Name,AdminDisplayVersion) or your CMDB.
• Document the build number. The latest version in this line is 15.2.1748.46. If your servers are not on that build, apply the latest available update now – but it will not change the EOL date.
• Note dependencies (e.g., co‑existing servers, public folders, SMTP connectors).

Isolate and Harden

Since you cannot (or will not) migrate before EOL, reduce the attack surface.

• Network segmentation: Place the Exchange servers in a separate VLAN with strict firewall rules. Allow only necessary inbound traffic (e.g., from trusted mail gateways, internal clients).
• Restrict administrative access: Use just-in-time (JIT) access controls and audit all admin logins.
• Disable unnecessary services: Turn off Outlook Anywhere, EWS, ActiveSync, or OWA if they are not strictly needed.
• Apply the latest Cumulative Update (CU) and Security Update (SU) that are still supported – but be aware that the main EOL date for CU15 SU8 is fixed. The last available update (15.2.1748.46) is already included in the EOL scope.

Document Exposure for Auditors and Insurers

Your compliance and risk teams will need to know why this unsupported system is still running.

• Create a risk acceptance document that lists each affected server, the EOL date, the compensating controls in place, and an owner.
• Update your cyber insurance questionnaire to reflect the EOL status and the controls you have implemented.
• Schedule a formal review with internal audit to sign off on the residual risk.

Line Up a Support Contract for Day One

The moment Microsoft support ends, you need a support partner that can provide:

• Security patches for critical vulnerabilities (often developed within hours of disclosure).
• Technical support for break-fix issues.
• Compliance coverage to satisfy auditors and insurers.

Third-party support providers like 3rd Party Support continue to support Exchange 2019 CU15 SU8 after the vendor’s EOL date. This gives you a bridge to a full migration without the risk of running unsupported software.

Week-by-Week Action Checklist (12 Weeks Until October 14, 2025)

Weeks 1–2: Inventory and Assessment

• Run a full scan of all Exchange servers. Identify the exact CU/SU and build number.
• Document every mail flow, connector, and integration point.
• Determine if any servers can be decommissioned immediately.

Weeks 3–4: Isolation and Hardening

• Apply firewall rules to restrict inbound and outbound traffic to the minimum required.
• Disable legacy protocols (e.g., Outlook Anywhere, RPC over HTTP) if not in use.
• Enable logging and monitoring for all Exchange traffic.
• Check that all servers are on build 15.2.1748.46. Apply the update if not.

Weeks 5–8: Documentation and Testing

• Draft the risk acceptance document with input from security and compliance.
• Test the isolation controls in a lab environment (or a non-critical server).
• Run a penetration test against the hardened Exchange environment.
• Update disaster recovery plans to reflect the EOL status.

Weeks 9–11: Final Hardening and Contract Negotiation

• Implement any remaining compensating controls (e.g., additional logging, WAF rules).
• Engage a third-party support provider and sign a contract that starts on October 14, 2025.
• Train the helpdesk and IT ops on how to report issues to the new support provider.

Week 12: Final Checks

• Verify all servers are still running and the hardening is in place.
• Confirm that the support contract is active and the provider has access credentials.
• Send a final communication to auditors and insurers about the EOL status and the agreed-upon support plan.

Summary

October 14, 2025 is not a day to panic – it is a deadline to act. By inventorying, isolating, hardening, and documenting your Exchange 2019 CU15 SU8 environment, you can safely run it past the vendor’s EOL date. And by securing a third-party support contract before the deadline, you ensure that you are never without a safety net.

Take the next three months to methodically reduce risk. Your auditors, your insurers, and your users will thank you.