18 exploited Exchange flaws, 14 used in ransomware: the cost of hosting your own mail

01The patch clock: 18 exploited Exchange flaws, and they keep coming

CISA’s Known Exploited Vulnerabilities catalogue lists flaws that attackers are known to have used, not merely ones a researcher found. Up to 30 September 2026 it held 1,730 entries. Eighteen are in Microsoft Exchange Server, the most widely self-hosted business mail server.¹ Each one is a patch the customer had to install; a hosted mailbox was fixed by its provider without any action from the customer.

The 2021 column holds the ProxyLogon and ProxyShell flaws behind that year’s mass exploitation of on-premises Exchange. The single entry in 2026 is CVE-2023-21529, a deserialisation flaw patched in 2023 that CISA added on 13 April 2026 once exploitation was seen.¹ That is the pattern a self-hosting team has to plan for: an old flaw becomes urgent years later, on someone else’s timetable.

02It is not an Exchange problem. Every self-hosted mail server is on the list

Moving off Exchange to an open-source server does not get you off the list. Zimbra Collaboration has more entries than Exchange; the Roundcube webmail many hosting panels bundle has eleven; the Exim mail transfer agent has five.¹ Across six mail-server products we count 57 exploited flaws.¹

There is a third model the 2023 post missed, and it is how many small Indian firms actually get email: the mailboxes bundled with a web-hosting plan. Those control panels commonly run Exim to move mail and Roundcube to read it, two products with 16 entries between them on the chart. The patching is the host’s job, not yours, but you cannot see whether it has been done, and the contract rarely says how fast it must be. If your mail lives on a shared-hosting plan, ask the host in writing for its patch window on a KEV-listed flaw.

03The support clock: Exchange 2016 and 2019 are out of free fixes

Exchange Server 2019’s extended support ended on 14 October 2025, the same day as Exchange 2016.² Microsoft’s replacement, Exchange Server Subscription Edition (SE), was released on 1 July 2025; it is the same code as Exchange 2019 CU15 with a new licence model. Running it needs server licences and client access licences with Software Assurance, or a cloud subscription for every user.³ For those who could not move in time, Microsoft sold a six-month Extended Security Update period that ran to 14 April 2026, priced per server through the account team, and opened a second paid period in May 2026 with separate enrolment.³ On a calendar the squeeze is plain: in under a year Microsoft released Exchange SE, ended free fixes for 2016 and 2019, and sold two rounds of paid updates to the customers who had not moved.

The licensing change removes the old argument that a server bought once is cheaper than rent paid forever. On-premises Exchange is now rent as well. What remains is the hardware, the backup, the spam filter, the certificates and the on-call engineer, all on your side.

The evidence against moving is real and worth stating. A hosted tenant gives up some control: retention and legal-hold settings follow the provider’s feature set, outages are the provider’s to fix on its timetable, and leaving later means exporting every mailbox. None of that is new. What changed between 2023 and 2026 is the other side of the ledger: the server you keep is no longer a one-time purchase, and its security fixes arrive on a schedule you do not set.

04Self-hosting narrows the security tools you can buy

The newest email-security products do not sit in front of a mail server at all. They connect to Microsoft 365 or Google Workspace through an API and read mail after the provider has filtered it. That design only exists for hosted mail. Of the 14 email filters in our email-security guide as it stood on 30 September 2026, three are API-only: Abnormal, Check Point Harmony Email & Collaboration and Coro.⁴

The five you can run yourself are Proofpoint, Barracuda, Fortinet FortiMail, Kaspersky and Forcepoint. Two of the 14 document an India data centre: Proofpoint and Sophos.⁴ A self-hosted estate still has choices, but it gives up the behavioural, API-based products that grew fastest after 2023, and it gives up the floor the hosted platforms include: Exchange Online Protection in every Microsoft 365 plan, and Gmail’s own filtering in every Workspace edition.⁴ Our email-security history piece follows what happened to the filters we listed in 2022.

05When keeping the server is still the right call

Self-hosting is defensible in a few cases, and they are narrower than the 2023 post suggested. We would keep a server only where a written obligation requires it, not because it feels safer.