Exchange Server Unsupported Version Detection: How to Upgrade to Exchange SE or Exchange Online

Microsoft Exchange Server Unsupported Version Detection means the scanner found an Exchange build Microsoft no longer supports: Exchange 2013 (support ended April 11, 2023) or 2016 and 2019 (ended October 14, 2025). Fix it by upgrading Exchange 2019 CU14 or CU15 in place to Exchange Server Subscription Edition (SE), migrating older versions to SE, or moving mailboxes to Exchange Online.

After that, decommission the old servers. The only exception is hybrid: keep one server, fully patched on SE, if you still need it to manage recipients.

What the scanner is actually detecting

Tenable ships two plugins for this, both rated Critical with a CVSS base score of 10.0:

Both checks rely on the version number Exchange reports about itself. Nessus 22313 reads the installed version from the host and compares it with Microsoft’s supported releases. Plugin 108802 does the same thing over the network without credentials. Neither one exploits anything. The plugin output shows the path and version that matched, and that is the first thing to read when you triage.

Real-world risk

There is no single CVE behind the 10.0 score. The problem is that any Exchange vulnerability disclosed after end of support will never get a public fix. Exchange is a frequent target: ProxyLogon was mass-exploited in 2021, and it is often published to the internet through OWA, EWS, ActiveSync or SMTP. When the hybrid flaw CVE-2025-53786 came out in August 2025, CISA’s Emergency Directive 25-02 ordered US federal agencies to disconnect Exchange servers that were no longer eligible for Microsoft’s hotfixes, which included end-of-life versions.

There is an operational cost as well. Exchange Online runs a transport-based enforcement system. It throttles mail from unsupported or badly outdated on-premises Exchange servers (SMTP 450 4.7.230) and, if nobody remediates the server, eventually blocks that mail. An internal-only server with no published endpoints carries less exposure than one with internet-facing OWA, but it still needs a plan with a date attached.

How to confirm it on the host

In the Exchange Management Shell, list every server with its CU level:

Get-ExchangeServer | Format-List Name,Edition,AdminDisplayVersion

This command shows the Cumulative Update level but not installed Security Updates. To get the exact build on a single server, run:

Get-Command Exsetup.exe | ForEach-Object {$_.FileVersionInfo}

Match the build to the product using Microsoft’s build number table:

For an organization-wide report on Exchange 2016, 2019 and SE, run Microsoft’s HealthChecker.ps1 from an elevated Exchange Management Shell:

Get-ExchangeServer | ?{$_.AdminDisplayVersion -Match "^Version 15"} | .HealthChecker.ps1
.HealthChecker.ps1 -BuildHtmlServersReport -HtmlReportFile "ExchangeAllServersReport.html"

How to fix it

Exchange 2019 CU14 or CU15: in-place upgrade to SE

This is the easy path. Exchange SE RTM contains the same code as Exchange 2019 CU15 plus the updates released since, and Microsoft supports installing it over 2019 CU14 or CU15 the same way you install a CU. Before you start, follow Microsoft’s CU guidance:

• Have a tested backup of both Active Directory and Exchange.
• Export any customizations (web.config, EdgeTransport.exe.config, TLS and cipher settings).
• Reboot the server first and temporarily disable antivirus during setup.
• Put DAG members into maintenance mode (StartDagServerMaintenance.ps1) and upgrade one server at a time.

The installing account needs Exchange Organization Management, and more rights if Setup has to update Active Directory. Mount the SE ISO and run:

E:Setup.exe /IAcceptExchangeServerLicenseTerms_DiagnosticDataON /Mode:Upgrade

If you do not want to send diagnostic data, use /IAcceptExchangeServerLicenseTerms_DiagnosticDataOFF instead. Restart when setup finishes, then install the latest SE Security Update. Exchange 2019 CU13 or earlier has to go to CU15 first. SE RTM keeps working with your existing product key. Microsoft has said a later SE CU will require a new key.

Exchange 2016 CU23: legacy upgrade

You cannot upgrade Exchange 2016 in place, and in-place upgrades of the Windows OS under Exchange are also unsupported. Build new servers on Windows Server 2019, 2022 or 2025 and install Exchange SE on them. Then move namespaces, certificates, connectors and all mailboxes, including arbitration and other system mailboxes, and uninstall Exchange 2016. Microsoft advises against using a new Exchange 2019 server as a stepping stone. Remove Exchange 2016 before Exchange SE CU2: its Setup will block coexistence with 2016 and 2019, and Microsoft’s May 2026 schedule places CU2 in the first half of 2027. If you run a build older than CU23, update to CU23 first.

Exchange 2013

Setup for both Exchange 2019 CU15 and SE RTM refuses to install in an organization that still has Exchange 2013. Microsoft’s path is to add an Exchange 2019 CU14 server, migrate to it, remove Exchange 2013, and then upgrade that server in place to SE. The other option is to move to Exchange Online.

Migrate Exchange to Exchange Online

After every mailbox and public folder has moved, follow Microsoft’s hybrid decommissioning guidance: point MX and Autodiscover (internal and external) to Exchange Online, clear the SCP values, and remove the hybrid configuration. If directory synchronization stays, you have two supported options:

• Keep one server (two is better) for recipient management, running SE and fully patched.
• Use the Exchange Management Tools without a running server. In that case, shut down the last server; do not uninstall it.

Keep a server running if it still handles SMTP relay or public folders.

If you cannot finish in time

Microsoft’s Extended Security Update (ESU) program for Exchange 2016 CU23 and 2019 CU14/CU15 is available only through an Enterprise Agreement. Period 2 ends at the end of October 2026, and Microsoft says it will not be extended again. ESU does not put the servers back in support. Until they are gone, remove internet publishing where you can, and record the exception with an owner and an expiry date through a formal vulnerability risk acceptance process.

How to verify the fix and rescan

1. Run Get-ExchangeServer again. Upgraded servers report Version 15.2 (Build 2562.x), and servers you retired should no longer be listed.
2. Check the ExSetup.exe build with the command above. As of September 2026 the latest release is Exchange Server SE RTM Sep26SU, build 15.2.2562.49.
3. Look for errors in C:ExchangeSetupLogsExchangeSetup.log and the Application event log, and review the HealthChecker HTML report.
4. Run a credentialed rescan so plugin 22313 can read the local install, and remove decommissioned hosts from the scan scope and the asset inventory.

Keep SE current from here on. Exchange Security Updates are released on Patch Tuesday when there is a fix to ship, so include them in your Patch Tuesday planning cycle.

What can break and how to roll back

• No uninstall path. Microsoft says you cannot uninstall a CU to go back to the previous version, because uninstalling removes Exchange completely. Plan for the in-place SE upgrade to work the same way. Your rollback options are restoring from backup, or rebuilding the server and letting the remaining DAG members carry the load.
• Customizations get overwritten. Setup replaces edited XML configuration files and OS TLS/cipher settings. Exchange 2019 CU13 and later back up and restore the most common files, but anything else has to be reapplied by hand.
• Third-party add-ons. Get SE support confirmed by the vendors of your backup agent, antivirus, transport agents and signature tools before you upgrade.
• Hybrid teardown. Uninstalling the last Exchange server breaks the management-tools approach, and Exchange RBAC stops working once it is shut down. Updating only external DNS leaves internal clients inconsistent.

Common false positive reasons

• ESU-covered servers are not false positives. Microsoft is explicit that ESU is not an extension of support. Track these servers as accepted risk with a date.
• Stale or mismatched version data. If the plugin output shows a 15.2.2562 build, the host is already on SE. Update the plugin set, rescan with credentials, and raise it with Tenable if the finding persists.
• Load balancers. The uncredentialed plugin 108802 may be reading a virtual IP that sits in front of several servers, including one you have not upgraded yet.
• Management hosts and leftovers. If the flagged host is not a mailbox or Edge server, check the path in the plugin output. It may be an old Management Tools install or files left behind by an incomplete uninstall.

FAQ

Is Exchange 2019 still supported?

No. Exchange 2016 end of support and Exchange 2019 end of support were both October 14, 2025. Exchange Server SE is the only supported on-premises version.

Can I upgrade Exchange 2016 directly to SE in place?

No. Only Exchange 2019 CU14 and CU15 support an in-place Exchange Server Subscription Edition upgrade. Exchange 2016 needs new servers and mailbox moves.

Do I need a new product key for Exchange SE?

Not for SE RTM. Microsoft has announced that a future cumulative update will introduce a new key requirement. Licensing also requires Software Assurance or qualifying cloud subscriptions.

After moving to Exchange Online, can I delete every Exchange server?

Only if you also turn off directory sync, or if you switch to the management tools and shut down (not uninstall) the last server. Otherwise keep one patched SE server for recipient management.

Tracking this finding across many hosts

An Exchange retirement usually takes months and spans several sites, so the hard part is knowing which servers are upgraded, which are under an exception, and which are really gone. If you use SITEY, you upload the .nessus export, it merges duplicate findings from the same scanner, and when you run a per-finding Nessus retest after each server is upgraded or retired, that retest confirms whether plugin 22313 has closed.

Sources

• Tenable: Nessus plugin 22313, Microsoft Exchange Server Unsupported Version Detection
• Tenable: Nessus plugin 108802, Microsoft Exchange Server Unsupported Version Detection (Uncredentialed)
• Microsoft Learn: Upgrading to Exchange Server Subscription Edition (SE)
• Microsoft Learn: Exchange Server build numbers and release dates
• Microsoft Exchange Team: Upgrading your organization from current versions to Exchange Server SE