Microsoft still does not have a release date for the first major cumulative update for Exchange Server Subscription Edition (SE). Interestingly, the growing use of AI to detect vulnerabilities is playing a role. The security issues these tools are uncovering are creating so much extra work for the Exchange team that CU1 will have to wait.
Exchange SE CU1 was initially scheduled for the first half of 2026. Microsoft had previously pushed that date back to the second half of the year. Now, the company no longer wants to commit to that timeline. A specific date is still unavailable, according to The Register.
More vulnerabilities found
Microsoft is increasingly using AI tools to detect vulnerabilities in its own software. This is resulting in a growing number of reports for the Exchange team. These cannot automatically be treated as security vulnerabilities. Developers must first determine whether a reported issue actually exists, reproduce it, and then develop a solution. Afterward, they must test whether the fix causes any new errors.
This work competes with the development and testing of CU1. Furthermore, Microsoft has explicitly prioritized security more in recent years. This shift followed, among other things, strong criticism from the U.S. government following earlier attacks on Exchange.
In the meantime, the vulnerabilities discovered are being addressed through the monthly security updates. Microsoft also incorporates these changes into the internal version of CU1 each time. As a result, the point at which that version is stable enough for a final release keeps getting pushed back.
Waiting for a quiet month
Microsoft does not intend to release CU1 until development has reached a stable point and no urgent security updates are issued in the meantime. In this way, the company aims to prevent administrators from having to perform another major Exchange update shortly after installing CU1.
For Microsoft itself, testing a cumulative update and a major security update simultaneously would also entail a significant amount of extra work. Furthermore, CU1 must include all changes released since the original release of Exchange SE.
Microsoft does not know when these conditions will be met. The company only confirms that CU1 is still in development and will eventually be released. This creates a notable side effect of AI-assisted security research: because Microsoft is finding vulnerabilities faster and potentially in greater numbers, it is becoming more difficult to find a suitable time for a major regular software update.