Microsoft’s next major Exchange Server update is still waiting for a clear runway. Exchange Server Subscription Edition Cumulative Update 1 has no firm release date as engineers work through security findings surfaced in part by AI-assisted vulnerability discovery.
The Exchange Team said Aug. 13, 2026, that reported issues still require validation, reproduction, remediation, and regression testing before fixes can ship. Microsoft is doing that work while continuing Exchange security releases, leaving administrators without a firm CU1 deployment date but no reason to delay routine patching.
AI-assisted security work slows the path to CU1
Microsoft initially expected CU1 by the end of the first half of 2026. On May 22, it updated the Exchange Server SE roadmap to target the second half of 2026, but its latest CU1-specific update did not provide a firmer date.
In its Aug. 13 CU1 update, Microsoft said Exchange is among the teams investigating issues identified as the company uses AI tools to help find vulnerabilities. Engineers must still determine whether each report represents a genuine security problem, reproduce it, develop a fix, and test for regressions.
The workload comes during an unusually busy stretch for Microsoft security teams. June’s Patch Tuesday addressed more than 200 reported flaws, while July’s release fixed a record 570 vulnerabilities. In August, Microsoft patched more than 400 vulnerabilities, including an actively exploited Windows zero-day.
Exchange fixes also feed into CU1. Microsoft says the cumulative update must incorporate everything released since Exchange Server SE reached RTM, and it wants to avoid shipping CU1 only to follow it quickly with another substantial security release.
CU1 carries more weight than a routine Security Update. Microsoft’s roadmap describes it as the first Exchange Server SE release expected to introduce new features; the initial SE release maintained code parity with Exchange Server 2019 CU15 plus subsequent updates.
Security updates remain the priority
Administrators should continue applying Security Updates rather than waiting for CU1. Microsoft issued its August 2026 Exchange Server Security Updates on Aug. 11 for Exchange Server SE, with updates also available to eligible Exchange Server 2016 and 2019 systems enrolled in the applicable Extended Security Update program.
Organizations should keep CU1-dependent change windows flexible until Microsoft publishes a firm schedule and final release notes. Once CU1 ships, administrators can review compatibility requirements and test the build before production deployment.
The timing is especially relevant for organizations still running older Exchange versions. Microsoft says the Exchange Server 2016 and 2019 ESU program ends after October 2026 with no further extension planned, and it continues to recommend moving remaining production servers to Exchange Server SE.
Until Microsoft announces a firm CU1 date, monthly security releases remain the immediate deployment priority. The Aug. 13 post remains Microsoft’s latest CU1-specific update as of Aug. 24, 2026.
Read more: Organizations managing broader Microsoft fleets can also see how Windows 11 hotpatching reduces required reboots on eligible managed devices while maintaining a regular security-update cycle.
