Microsoft Delays Email Server Upgrade to Patch More Security Flaws

Exchange Server is the software many companies use to run their own business email. Microsoft's next major refresh, called Cumulative Update 1, was supposed to add new features. But Microsoft says engineers are still reviewing security problems that were uncovered in part by AI-assisted tools. The company won't ship the update until every reported issue is checked, fixed, and tested — and that takes time.

It's been a heavy season for Microsoft's security team. In June, they patched more than 200 flaws. In July, they fixed a record 570. In August, they handled over 400, including a Windows bug that was already being attacked in the wild. The Exchange team is also folding all those fixes into the delayed update, so it keeps growing and the checklist keeps getting longer.

Microsoft originally hoped to release CU1 by mid-2026, then pushed it to later in the year. Now they've stopped giving a firm date. The good news: monthly security updates are still coming out on schedule. Those are the patches that stop active attacks, and Microsoft says you should keep installing them right away — don't wait for the big update.

For businesses, the practical advice is simple. Keep applying the monthly security updates as usual. If you planned to do a big upgrade around CU1, keep your schedule flexible. And if you're still running older Exchange versions, Microsoft is ending extended support after October 2026, so moving to the newer version is still the best long-term plan — just don't expect it to happen next week.