If your business runs an on-premises Exchange mailbox server, a perpetual copy of Office 2021, or Windows Server 2012, October 2026 is the month all three officially stop getting security updates. Office 2021 support ends on 13 October, the last Exchange Server 2016/2019 extended security updates run out on 31 October, and Windows Server 2012's final Extended Security Update window also closes in mid-October. After those dates, any newly discovered vulnerability in that software is one your business carries with no patch coming — ever.
Why three unrelated products are ending on the same page
These aren't linked by a single Microsoft decision — they're just three separate five-to-fourteen-year support clocks that happen to run out in the same few weeks. But for a lot of small and medium Perth businesses, they land on the same server room. It's common for a business running an ageing on-premises Exchange server to also be on an old perpetual Office licence and an old Windows Server box underneath it all, because none of it has been touched since it was set up. If that sounds familiar, this month is worth an actual look rather than another "we'll get to it."
Exchange Server 2016/2019: this is the real deadline
Mainstream support for Exchange Server 2016 and 2019 technically ended back in October 2025, but Microsoft has been shipping security-only updates through a final Extended Security Update (ESU) period since then. That ESU period ends on 31 October 2026, and Microsoft has confirmed there will be no further extension. If you're still running mail on-premises rather than in Exchange Online, this is the actual, final cut-off.
Practically, an unpatched Exchange server isn't a quiet risk — Exchange has been one of the most consistently exploited pieces of enterprise software of the last five years (think ProxyLogon, ProxyShell and the string of vulnerabilities since), precisely because a compromised mail server hands an attacker a foothold into everything else on the network: user credentials, the address book, and often a path to the rest of the domain. Running one with no further patches available isn't a compliance footnote, it's an open door.
For most SMBs the sane move at this point isn't a new on-premises server — it's finally migrating those mailboxes to Exchange Online as part of Microsoft 365. It removes the patching problem entirely, because Microsoft manages the server security, not you.
Office 2021: the desktop apps quietly age out too
Office 2021 (Word, Excel, Outlook, PowerPoint as a one-off purchase rather than a subscription) reaches its five-year end-of-support date on 13 October 2026. The applications won't stop opening on that date, but they stop receiving security fixes, and — separately from security — Office 2021 was never entitled to connect to newer cloud services the way a Microsoft 365 subscription is. If your business bought perpetual Office licences a few years ago to avoid a subscription, this is the point where that decision needs revisiting, particularly for any machine that opens attachments from external senders, which is most of them.
Windows Server 2012: the one that's easy to forget is still running
Windows Server 2012 and 2012 R2 have been out of mainstream support for years, kept alive only by paid Extended Security Updates for businesses that couldn't migrate off them in time. That paid ESU program also reaches its final year in October 2026. If there's a Windows Server 2012 box anywhere in your business — and it's surprisingly common to find one quietly running a line-of-business app, a file share, or a print server nobody has thought about since it was installed — this is worth confirming rather than assuming someone else already checked it.
What to actually do this week
You don't need to solve all three at once, but you do need to know where you stand:
- Ask what mail server you're actually on. If it's an on-premises Exchange server rather than Exchange Online, treat 31 October as a hard deadline, not a soft one.
- Check whether any desktop still runs Office 2021 (or older) rather than a Microsoft 365 subscription. It's usually visible in Outlook or Word under "Account".
- Have someone physically confirm there's no forgotten Windows Server 2012 machine. A dusty tower under a desk counts.
- Prioritise by exposure, not by age. A Windows Server 2012 box that's air-gapped and does nothing internet-facing is a lower-urgency problem than an internet-facing Exchange server taking mail from the outside world.
None of these migrations are same-day jobs — moving mailboxes, replacing a domain controller, or re-licensing Office across a fleet of PCs all take planning and, usually, a maintenance window. The businesses that come through this cleanly are the ones sorting it out in the weeks before the deadline, not the ones finding out about it from an alert after the fact.
Where this fits with the rest of your IT
If any of the above describes your setup, it's worth a proper stocktake of what's running on-premises versus what's already moved to the cloud — our on-premises server management page covers what a supported on-prem environment actually looks like if you're not ready to move everything to the cloud yet. For the mailbox side specifically, our Microsoft 365 for Perth businesses guide walks through what a migration off Exchange on-premises involves and what it typically costs. And whatever you decide to keep running locally a little longer, make sure it's actually backed up — our backup and disaster recovery page is worth a read if you're not confident an unpatched server would survive an incident. If budget is the sticking point, our Perth MSP pricing guide breaks down what these projects typically cost so you can plan rather than guess.
We've been doing this kind of migration for Perth businesses since 1997, including the exact "we didn't realise that was still running" conversations these deadlines tend to trigger. If you're not sure what's ageing out in your environment, it's a five-minute phone call to find out — better now than in November.
