--- title: "18 exploited Exchange flaws, 14 used in ransomware: the cost of hosting your own mail" summary: "CISA's exploited-flaw list, Microsoft's Exchange lifecycle and the 14 email filters we track, counted to 30 September 2026: what self-hosting mail now commits you to." url: https://www.thetechbag.com/blog/email-hosting-internal-external-hosting format: Analysis desk: "Cloud & DevOps" published: 2025-12-23 facts_checked: 2026-09-30 author: TechBag (The TechBag Journal) tags: ["email hosting","Exchange Server","Exchange SE","CISA KEV","Zimbra","Microsoft 365","email security","CERT-In","DPDP","self-hosting"] cover: https://www.thetechbag.com/blog/covers/email-hosting-internal-external-hosting.png --- # 18 exploited Exchange flaws, 14 used in ransomware: the cost of hosting your own mail *CISA's exploited-flaw list, Microsoft's Exchange lifecycle and the 14 email filters we track, counted to 30 September 2026: what self-hosting mail now commits you to.* Analysis · Cloud & DevOps · By TechBag · Published 2025-12-23 · Facts checked 2026-09-30 · Canonical: https://www.thetechbag.com/blog/email-hosting-internal-external-hosting The short version - Hosting your own email means patching it on an attacker’s schedule. Exchange Server appears 18 times on CISA’s list of flaws exploited in the wild, and 14 of those are known to have been used in ransomware campaigns.[1] - Free security fixes for Exchange 2016 and 2019 ended on 14 October 2025. Staying on-premises now means Exchange Server Subscription Edition, with subscription licences or Software Assurance, or a paid per-server update programme.[2][3] - Self-hosting also narrows the security market: 3 of the 14 email filters we track work only with Microsoft 365 or Google Workspace.[4] Keep a server only if a regulator or contract requires the mail to stay in your building. Our 2023 post framed this as control against convenience: run your own mail server and own everything, or rent a mailbox and give some of that up. Three years on, the question an Indian IT head is really answering is narrower. Who applies the emergency patch when the mail server is being exploited, how fast, and what does it cost to keep the server supported at all? The numbers below answer that, and they lean hard one way. ## The patch clock: 18 exploited Exchange flaws, and they keep coming CISA’s Known Exploited Vulnerabilities catalogue lists flaws that attackers are known to have used, not merely ones a researcher found. Up to 30 September 2026 it held 1,730 entries. Eighteen are in Microsoft Exchange Server, the most widely self-hosted business mail server.[1] Each one is a patch the customer had to install; a hosted mailbox was fixed by its provider without any action from the customer. TechBag countHow we counted We downloaded the catalogue as CSV, kept entries added on or before 30 September 2026, and counted those whose vendor is Microsoft and whose product is Exchange Server (17) or Exchange (1). The Windows “Internet Key Exchange” entry was excluded. Fourteen of the 18 carry CISA’s “Known” flag for ransomware use. **Figure: Exchange Server flaws reached CISA's exploited list every year but one since the list began** *Microsoft Exchange Server entries in CISA's KEV catalogue, by year added, November 2021 to September 2026* | | Exchange entries added | | --- | --- | | 2021 | 10 | | 2022 | 4 | | 2023 | 1 | | 2024 | 2 | | 2025 | 0 | | 2026 | 1 | Source: CISA Known Exploited Vulnerabilities catalogue (CSV), TechBag count · as of 30 September 2026 · 2021 includes the backlog loaded when the catalogue launched in November 2021 The 2021 column holds the ProxyLogon and ProxyShell flaws behind that year’s mass exploitation of on-premises Exchange. The single entry in 2026 is CVE-2023-21529, a deserialisation flaw patched in 2023 that CISA added on 13 April 2026 once exploitation was seen.[1] That is the pattern a self-hosting team has to plan for: an old flaw becomes urgent years later, on someone else’s timetable. ## It is not an Exchange problem. Every self-hosted mail server is on the list Moving off Exchange to an open-source server does not get you off the list. Zimbra Collaboration has more entries than Exchange; the Roundcube webmail many hosting panels bundle has eleven; the Exim mail transfer agent has five.[1] Across six mail-server products we count 57 exploited flaws.[1] **Figure: Zimbra has more exploited flaws than Exchange; switching servers does not leave the list** *Entries in CISA's KEV catalogue by self-hosted mail product, all years to 30 September 2026* Zimbra Collaboration 19 entries Microsoft Exchange Server 18 entries Roundcube Webmail 11 entries Exim 5 entries SmarterMail 3 entries MDaemon Email Server 1 entries | | Value (entries) | | --- | --- | | Zimbra Collaboration | 19 | | Microsoft Exchange Server | 18 | | Roundcube Webmail | 11 | | Exim | 5 | | SmarterMail | 3 | | MDaemon Email Server | 1 | Source: CISA Known Exploited Vulnerabilities catalogue (CSV), TechBag count · as of 30 September 2026 · product names normalised; one Cisco email gateway entry excluded as a filter, not a mail server There is a third model the 2023 post missed, and it is how many small Indian firms actually get email: the mailboxes bundled with a web-hosting plan. Those control panels commonly run Exim to move mail and Roundcube to read it, two products with 16 entries between them on the chart. The patching is the host’s job, not yours, but you cannot see whether it has been done, and the contract rarely says how fast it must be. If your mail lives on a shared-hosting plan, ask the host in writing for its patch window on a KEV-listed flaw. Our view Our view: the count is not a ranking of which server is safest. Popular software attracts attackers, and a product with one entry may simply have fewer users. The point is that every option on this chart puts the patch on your team’s desk. If that team is two people who also run the network, that is the risk you are taking on. ## The support clock: Exchange 2016 and 2019 are out of free fixes Exchange Server 2019’s extended support ended on 14 October 2025, the same day as Exchange 2016.[2] Microsoft’s replacement, Exchange Server Subscription Edition (SE), was released on 1 July 2025; it is the same code as Exchange 2019 CU15 with a new licence model. Running it needs server licences and client access licences with Software Assurance, or a cloud subscription for every user.[3] For those who could not move in time, Microsoft sold a six-month Extended Security Update period that ran to 14 April 2026, priced per server through the account team, and opened a second paid period in May 2026 with separate enrolment.[3] On a calendar the squeeze is plain: in under a year Microsoft released Exchange SE, ended free fixes for 2016 and 2019, and sold two rounds of paid updates to the customers who had not moved. **Figure: Self-hosted Exchange now has a subscription either way: SE licences or paid per-server updates** *Exchange Server lifecycle milestones, July 2025 to May 2026* | Date | Event | Detail | | --- | --- | --- | | Jul 2025 | Exchange SE released | 1 July 2025; same code as Exchange 2019 CU15, needs licences with Software Assurance or cloud subscriptions per user | | Oct 2025 | 2016 and 2019 out of support | 14 October 2025; no more free security updates for either version | | Apr 2026 | First paid ESU period ends | 14 April 2026; six months of fixes, priced per server via Microsoft’s account team | | May 2026 | Second ESU period opens | May 2026; another six months, separate enrolment, an additional fee, not an extension of support | Source: Microsoft Lifecycle (Exchange Server 2019); CodeTwo summary of Microsoft's Exchange SE and ESU announcements · as of 30 September 2026 · Next: SE CU2, planned for the second half of 2026, is to block coexistence with Exchange 2016 and 2019 servers in the same organisation The licensing change removes the old argument that a server bought once is cheaper than rent paid forever. On-premises Exchange is now rent as well. What remains is the hardware, the backup, the spam filter, the certificates and the on-call engineer, all on your side. The evidence against moving is real and worth stating. A hosted tenant gives up some control: retention and legal-hold settings follow the provider’s feature set, outages are the provider’s to fix on its timetable, and leaving later means exporting every mailbox. None of that is new. What changed between 2023 and 2026 is the other side of the ledger: the server you keep is no longer a one-time purchase, and its security fixes arrive on a schedule you do not set. ## Self-hosting narrows the security tools you can buy The newest email-security products do not sit in front of a mail server at all. They connect to Microsoft 365 or Google Workspace through an API and read mail after the provider has filtered it. That design only exists for hosted mail. Of the 14 email filters in our email-security guide as it stood on 30 September 2026, three are API-only: Abnormal, Check Point Harmony Email & Collaboration and Coro.[4] **Figure: 10 of 14 email filters can still front a self-hosted server; only 5 run on your own hardware** *Email filters in TechBag's email-security guide by documented deployment mode, September 2026 (categories overlap)* Can run as an MX gateway in front of any server 10 filters Can run on your own appliance or VM 5 filters API-only: Microsoft 365 or Google Workspace 3 filters Deployment mode not documented 1 filters | | Value (filters) | | --- | --- | | Can run as an MX gateway in front of any server | 10 | | Can run on your own appliance or VM | 5 | | API-only: Microsoft 365 or Google Workspace | 3 | | Deployment mode not documented | 1 | Source: TechBag email-security guide, vendor-doc-verified 22 August 2026, TechBag count · as of 30 September 2026 The five you can run yourself are Proofpoint, Barracuda, Fortinet FortiMail, Kaspersky and Forcepoint. Two of the 14 document an India data centre: Proofpoint and Sophos.[4] A self-hosted estate still has choices, but it gives up the behavioural, API-based products that grew fastest after 2023, and it gives up the floor the hosted platforms include: Exchange Online Protection in every Microsoft 365 plan, and Gmail’s own filtering in every Workspace edition.[4] Our [email-security history piece](https://www.thetechbag.com/blog/15-top-best-e-mail-security-software) follows what happened to the filters we listed in 2022. ## When keeping the server is still the right call Self-hosting is defensible in a few cases, and they are narrower than the 2023 post suggested. We would keep a server only where a written obligation requires it, not because it feels safer. **Figure: Keep the server for an obligation; rent the mailbox for everything else** *TechBag's decision rule for Indian organisations, as of September 2026* Keep it in-house if - A regulator, contract or government client requires mail to stay on infrastructure you control - The network is air-gapped or classified and cannot reach a cloud tenant - You have a named team that can patch within days and is on call when a KEV entry lands - You have budgeted SE licences with Software Assurance, or paid updates, plus a gateway filter Rent the mailbox if - Your mail admin is also your network, desktop and printer admin - You want the API-based behavioural filters, which need a hosted tenant - An India data region from the provider meets your residency requirement - You would rather pay per user than for hardware, backups and an on-call rota Source: TechBag analysis of the counts above and the obligations in the India section · as of 30 September 2026 Our view Our view: the honest middle ground is not “hybrid” for its own sake. It is a hosted tenant for most staff, with a small, well-patched on-premises server only for the mailboxes an obligation names, and a gateway filter in front of both. If you are buying this in India **Cost.** Hosted mail in India is priced per user per month in rupees. Our Microsoft 365 page lists Business Basic, which includes an Exchange Online mailbox, at ₹145 a user a month on annual commitment, plus 18% GST.[5] Exchange SE has no published rupee price: server licences, client access licences and Software Assurance are quoted by a reseller in INR plus 18% GST, and the paid update programme is priced per server by Microsoft.[3] TechBag resells Microsoft 365 and IceWarp, whose mail server runs either hosted or on your own hardware; the [IceWarp page](https://www.thetechbag.com/icewarp/icewarp-mail) covers that option. **Regulation.** CERT-In’s Directions of 28 April 2022 apply either way: report a cyber incident within six hours and keep ICT logs for 180 days within Indian jurisdiction. On a self-hosted server those logs are yours to keep.[6] The DPDP Rules were notified on 13 November 2025, with the duty to keep reasonable security safeguards in force from 13 May 2027; the Act sets penalties of up to ₹250 crore for failing that duty.[7][8] Banks also answer to RBI’s Cybersecurity, Technology Risk and Resilience Framework Directions of 31 July 2026, which require vulnerability assessment of internet-facing systems every six months.[9] An internet-facing mail server is exactly that kind of system. How we did this Figures as of 30 September 2026 The exploited-vulnerability counts are TechBag’s count of CISA’s KEV catalogue CSV, restricted to entries whose date added is on or before 30 September 2026. Product names that CISA spells several ways (four spellings of Zimbra, three of Exim, two of Roundcube) were merged. The filter counts come from the email-security guide as committed on 30 September 2026 (14 products of kind “filter”; awareness, DMARC, collaboration and account-takeover add-ons excluded); deployment modes overlap, so the bars do not sum to 14. Exchange lifecycle dates are from Microsoft’s lifecycle page; Exchange SE licensing and the update programme are from CodeTwo’s summary of Microsoft’s announcements, last updated 17 April 2026. The rupee price is from TechBag’s Microsoft 365 page as it stood on 30 September 2026. Hosted providers’ own vulnerabilities do not appear in KEV in the same way, because the provider patches them; we draw no comparison of their security from the catalogue. Spotted an error? Write to us; corrections are published at the foot of the piece. Sources 1. [CISA, Known Exploited Vulnerabilities catalogue (CSV); entries added to 30 September 2026, TechBag count](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) — entries dated November 2021 to 30 September 2026 2. [Microsoft Lifecycle, Exchange Server 2019](https://learn.microsoft.com/en-us/lifecycle/products/exchange-server-2019) — page updated 28 August 2024 3. [CodeTwo, Exchange Server Subscription Edition (SE): what you need to know](https://www.codetwo.com/admins-blog/exchange-server-subscription-edition/) — last updated 17 April 2026 4. [TechBag, Email & collaboration security guide (version of 30 September 2026)](https://www.thetechbag.com/browse/security/email-security) — vendor-doc-verified 22 August 2026 5. [TechBag, Microsoft 365 plans and pricing (version of 30 September 2026)](https://www.thetechbag.com/microsoft/microsoft-365) — INR annual list, mid-2026 6. [CERT-In, Directions under section 70B(6) of the IT Act](https://www.cert-in.org.in/Directions70B.jsp) — 28 April 2022 7. [DPDP Rules 2025, commencement timeline](https://legismith.com/dpdp-rules-2025-timeline/) — notified 13 November 2025 8. [Digital Personal Data Protection Act, 2023, Schedule (penalties)](https://www.meity.gov.in/data-protection-framework) — 11 August 2023 9. [RBI, Cybersecurity, Technology Risk and Resilience Framework Directions, 2026, via practitioner summary](https://taxguru.in/rbi/rbi-issues-commercial-banks-cybersecurity-technology-risk-resilience-framework-directions-2026.html) — 31 July 2026 RBI PDF not fetched. **Disclosure.** TechBag is a software reseller: it earns a margin when a reader buys through it, including from vendors named here. The analysis is TechBag’s own; no vendor paid for or saw this piece before publication. Facts are labelled reported, TechBag count or our view. Go deeper on TechBag - [Email & collaboration security guide](https://www.thetechbag.com/browse/security/email-security) — gateway, API and on-premises filters, by deployment mode - [IceWarp Mail](https://www.thetechbag.com/icewarp/icewarp-mail) — business mail hosted or on your own server, sold in India - [Microsoft 365 plans](https://www.thetechbag.com/microsoft/microsoft-365) — Exchange Online mailboxes by plan, priced in INR