Exchange Server SE CU1 Delayed as Microsoft Prioritizes Security Fixes
Microsoft advises customers to stay current with Exchange SE security updates rather than wait for CU1.
Key Takeaways:
- Microsoft has delayed Exchange Server SE CU1 and has not provided a new release date.
- Microsoft attributes the delay in part to increased security research and vulnerability remediation efforts.
- Organizations are encouraged to continue deploying monthly Exchange SE security updates.
If you’ve been wondering what happened to Exchange SE CU1, you’re not alone. Microsoft has published a new blog post explaining the delay and detailing how its increased focus on security and growing number of vulnerability fixes are affecting the way Exchange updates are developed and released.
Exchange Server Subscription Edition (SE) is an on-premises email and calendaring platform that launched in July 2025. It’s designed for organizations that want to keep Exchange running in their own data centers while receiving ongoing updates through a subscription-based lifecycle.
A Cumulative Update (CU) is a major package that combines all previous fixes, security patches, and product improvements into a single installation. It allows IT admins to keep servers fully up to date without applying multiple updates individually.
Microsoft delays CU1 to prioritize security and quality
Microsoft has been investing heavily in AI-assisted security research and vulnerability detection across its products, including Exchange Server. These efforts have helped identify more security issues, which then need to be validated, fixed, and tested before release. Consequently, Microsoft has been prioritizing monthly security updates for commercial customers. Exchange Server received security updates in May, June, July, and August, and Microsoft expects this faster update cadence to continue.
“Over the last few months, various Microsoft execs made statements explaining how Microsoft is leveraging a variety of AI tools to help find vulnerabilities in our products,” the Exchange team explained. “It should come as no surprise that this is a Microsoft-wide initiative. Many teams, Exchange Server included, are working through reported issues – which includes validation that they are real security issues, reproducing, fixing, testing for regressions / issues after fixes are deployed and releasing updates monthly.”
Microsoft Exchange Server SE CU1 has no new release date yet
Microsoft originally expected CU1 to be released by the end of the first half of 2026, but later pushed the timeline to the second half of the year. The company has now delayed the update again, and there is currently no new estimated release date.
Interestingly, Microsoft says the delay is intentional because development is still underway. The Exchange team is continuing to add the latest security fixes to the CU1 build, which ensures the cumulative update includes recent improvements and protections.
Microsoft recommends staying current while CU1 is delayed
Microsoft recommends organizations continue moving to Exchange Server SE, rather than waiting for CU1 to arrive. The company emphasized that Exchange SE remains the latest supported platform and that customers should keep their environments updated with the latest security releases.
Microsoft advises that organizations already running Exchange Server SE should maintain a consistent patching routine and stay current with monthly security updates. Microsoft argues that this approach provides the strongest protection while it continues work on CU1, which will eventually consolidate all recent fixes and improvements into a single package.
Rabia has a master's degree in Software Engineering and she has years of experience writing professionally about Microsoft products and other technologies. Rabia has also written for OnMSFT.com as well as Windows Report. She is always up to date on t...